CVE-2023-38909

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the IV component in the AES128-CBC function.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://arxiv.org/abs/2308.09019Third Party Advisory
https://arxiv.org/pdf/2308.09019.pdfExploit, Technical Description, Third Party Advisory
https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/
https://www.scitepress.org/Papers/2023/120929/120929.pdf
https://www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=&t=1Third Party Advisory
https://arxiv.org/abs/2308.09019Third Party Advisory
https://arxiv.org/pdf/2308.09019.pdfExploit, Technical Description, Third Party Advisory
https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/
https://www.scitepress.org/Papers/2023/120929/120929.pdf
https://www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=&t=1Third Party Advisory

Timeline

Published: Aug 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-38917.0Race condition in Lapce v0.2.8 allows an attacker to elevate privileges on the system CVE-2023-389106.1CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HTML via a crafted pay CVE-2023-389115.4A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery CVE-2023-389129.8SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload CVE-2023-389135.3SQL injection vulnerability in anirbandutta9 NEWS-BUZZ v.1.0 allows a remote attacker to execute arbitrary code via a crafted script.CVE-2023-389159.8File Upload vulnerability in Wolf-leo EasyAdmin8 v.1.0 allows a remote attacker to execute arbtirary code via the upload type function.CVE-2023-389168.8SQL Injection vulnerability in eVotingSystem-PHP v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information v CVE-2023-38927.4Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity CVE-2023-389204.8Cross Site Scripting vulnerability in Cyber Cafe Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted scr CVE-2023-389218.8Netgear WG302v2 v5.2.9 and WAG302v2 v5.1.19 were discovered to contain multiple command injection vulnerabilities in the upgrade_handler fun CVE-2023-389228.8Netgear JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7 were discovered to contain multiple buffer overflows via the http_pa CVE-2023-389246.5Netgear DGN3500 1.1.00.37 was discovered to contain a buffer overflow via the http_password parameter at setup.cgi.