Tapo Cloud MQTT proxy broken access control
Attackers could plant fake records in someone else's Tapo cloud.
Summary
The Tapo Cloud MQTT proxy does not check that a device ID belongs to the requester, so an attacker who owns a Tapo device and knows another device's ID can upload arbitrary content to that user's cloud storage. The content may appear in the Tapo app as a legitimate event.
What to do
TP-Link fixed it on the Tapo Cloud servers; owners need do nothing.
Products and platforms
CVE IDs
Sources
- Advisory: tp-link.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen