CVE-2023-38907

CVE-2023-38907 affects TP-Link Smart Bulb Tapo series: L530 (versions before 1.2.4), L510E (before 1.1.0), L630 (before 1.0.4), P100 (before 1.5.0), and Tapo Application (2.8.14). A remote attacker can replay old messages that were encrypted with a still valid session key, potentially obtaining s...

CVE-2023-38906

TP-Link Tapo family vulnerability CVE-2023-38906 affects L530 (1.0.0–1.1.9), L510E (1.0.8), L630 (1.0.3), P100 (1.4.9), C200 (1.1.18), and Tapo App 2.8.14. Description: remote attacker can obtain sensitive information via the authentication code in UDP messages. Root cause: lack of protection for...

CVE-2023-38909

The CVE-2023-38909 issue affects TP-Link Smart Bulb Tapo Series: L530 (<1.2.4), L510E (<1.1.0), L630 (<1.0.4), P100 (

CVE-2023-38908

The CVE-2023-38908 entry concerns TP-Link Smart Bulb Tapo series with multiple affected devices and firmware versions (L530 < 1.2.4; L510E < 1.1.0; L630 < 1.0.4; P100

CVE-2023-27098

Summary: CVE-2023-27098 affects the TP-Link Tapo APK up to v2.12.703, where the login panel is protected by hardcoded credentials. This Java/mobile app issue enables unauthorized access to protected login functionality, potentially exposing user data. What’s affected: TP-Link Tapo APK (Android) v...

CVE-2023-34829

CVE-2023-34829 affects TP-Link Tapo prior to v3.1.315. The issue is incorrect access control that allows an attacker to obtain user credentials in plaintext, exposing confidentiality (base score 6.5, MEDIUM). The vulnerability impacts authentication/credential handling and is supported by multipl...

CVE-2025-9292

CVE-2025-9292 affects TP-Link Omada Cloud Controller. A permissive web security configuration may bypass cross-origin restrictions in certain conditions, enabling potential unauthorized disclosure of sensitive data. Exploitation requires an existing client-side injection vulnerability and access ...

CVE-2025-9293

The CVE-2025-9293 entry describes a vulnerability in TLS certificate validation across multiple mobile applications. Root cause: insufficient validation of server identities during TLS, enabling an attacker in a privileged network position to intercept or modify traffic. Impact includes confident...