CVE-2023-38907 Other in n/a
Remote attackers can replay encrypted messages using valid session keys, bypassing security controls in TP-Link smart bulbs and plugs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-38907?
CVE-2023-38907 is a high-severity vulnerability in n/a, published on 25 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to replay old messages encrypted with a still valid session key.
Which versions are affected by CVE-2023-38907?
It affects 2 products.
Products include Tp-Link Tapo, Tp-Link Tapo L530e Firmware.
How do I fix CVE-2023-38907?
No fix has been published for CVE-2023-38907 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-38907 being exploited?
There is no known exploitation of CVE-2023-38907 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-pp6v-57ch-47rf.