CVE-2023-38909
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
An issue in TPLink Smart Bulb Tapo series (L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14) allows a remote attacker to obtain sensitive information via the IV component in the AES128-CBC function.
Risk Assessment
An attacker can gain access to sensitive data, potentially leading to further attacks on the organization's infrastructure.
Recommendation
It is recommended to update the devices to the latest software versions to mitigate the risk associated with this vulnerability.
Original NVD description (English source)
An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the IV component in the AES128-CBC function.