cnvd - cnvd-2023-66236

cnvd-2023-66236

Vulnerability from cnvd

Title

TP-LINK Smart bulb Tapo series L530和Tapo Application信息泄露漏洞

Description

TP-LINK Smart bulb Tapo是中国普联（TP-LINK）公司的一款智能灯泡。 TP-LINK Smart bulb Tapo series L530和Tapo Application存在信息泄露漏洞，攻击者可利用该漏洞通过AES128-CBC功能中的IV组件获取敏感信息。

Severity

中

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://www.tp-link.com.cn/

Reference

https://arxiv.org/pdf/2308.09019.pdf

Impacted products

Name
['TP-LINK Smart bulb Tapo series L530 v1.0.0', 'TP-LINK Tapo Application v2.8.14']

Show details on source website

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-38909",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-38909"
    }
  },
  "description": "TP-LINK Smart bulb Tapo\u662f\u4e2d\u56fd\u666e\u8054\uff08TP-LINK\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u667a\u80fd\u706f\u6ce1\u3002\n\nTP-LINK Smart bulb Tapo series L530\u548cTapo Application\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7AES128-CBC\u529f\u80fd\u4e2d\u7684IV\u7ec4\u4ef6\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://www.tp-link.com.cn/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-66236",
  "openTime": "2023-08-31",
  "products": {
    "product": [
      "TP-LINK Smart bulb Tapo series L530 v1.0.0",
      "TP-LINK Tapo Application v2.8.14"
    ]
  },
  "referenceLink": "https://arxiv.org/pdf/2308.09019.pdf",
  "serverity": "\u4e2d",
  "submitTime": "2023-08-30",
  "title": "TP-LINK Smart bulb Tapo series L530\u548cTapo Application\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2023-38909 (GCVE-0-2023-38909)

Vulnerability from cvelistv5

Published

2023-08-22 00:00

Modified

2024-08-02 17:54

Severity ?

CWE

n/a

Summary

An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the IV component in the AES128-CBC function.

References

URL

Tags

	https://www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=&t=1
	https://arxiv.org/abs/2308.09019
	https://arxiv.org/pdf/2308.09019.pdf
	https://www.scitepress.org/Papers/2023/120929/120929.pdf
	https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:54:39.599Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=\u0026t=1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://arxiv.org/abs/2308.09019"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://arxiv.org/pdf/2308.09019.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.scitepress.org/Papers/2023/120929/120929.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the IV component in the AES128-CBC function."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-07T14:26:21.306503",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=\u0026t=1"
        },
        {
          "url": "https://arxiv.org/abs/2308.09019"
        },
        {
          "url": "https://arxiv.org/pdf/2308.09019.pdf"
        },
        {
          "url": "https://www.scitepress.org/Papers/2023/120929/120929.pdf"
        },
        {
          "url": "https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-38909",
    "datePublished": "2023-08-22T00:00:00",
    "dateReserved": "2023-07-25T00:00:00",
    "dateUpdated": "2024-08-02T17:54:39.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.