TP-Link Tapo L530E (L530E)

TP-Link Tapo L530E (L530E)
Security Grade D Calculator v	TP-Link Tapo L530E (L530E) Brand: TP-Link (Parent: TP-Link Systems Inc.) Category: Smart Light • Model / Gen: L530E Release Date: 2021-01-01 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	—	No published hardware-tampering research for this bulb was found as of 2026-10. The bulb is a sealed glass and plastic unit with no external ports.
Known vulnerabilities	Rare	[https://nvd.nist.gov/vuln/detail/CVE-2023-38907 https://nvd.nist.gov/vuln/detail/CVE-2023-38906 🔗 Proof]	Four CVEs name Tapo L530 directly. CVE-2023-38907 (CVSS 7.5) allows a remote attacker to replay old messages encrypted with a still-valid session key. CVE-2023-38909 (6.5) leaks information through the AES128-CBC IV component, CVE-2023-38908 (6.5) through the TSKEP authentication function, and CVE-2023-38906 (6.5) through the authentication code. All four were fixed in L530 1.2.4.
Prior attacks	None	—	No campaign naming this bulb was found. Smart bulbs are a low-value target compared with cameras and routers, and no recorded exploitation of this model exists. Provisional value.
Updatability	Rare	🔗 Proof	TP-Link shipped firmware 1.2.4 to close all four CVEs, and bulbs are updated through the Tapo app, but updates require the owner to keep the app current, so bulbs in the field commonly remain on the pre-1.2.4 builds named in the CVE records.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	CVE-2023-38907 shows a session key can remain valid long enough for old messages to be replayed, so the authentication binding between the app and the bulb does not reliably prove freshness of the peer.
Communications	Encrypted with obselete encryption	[https://nvd.nist.gov/vuln/detail/CVE-2023-38909 https://nvd.nist.gov/vuln/detail/CVE-2023-38908 🔗 Proof]	Traffic is encrypted, but the implementation is flawed: CVE-2023-38909 concerns the AES128-CBC IV component and CVE-2023-38908 the TSKEP authentication function. Encryption is present, so this is not the unencrypted case, but the scheme as shipped was not sound, which is why the obsolete-encryption value applies.
Storage	No encryption	—	No at-rest encryption is documented for Wi-Fi credentials held on the bulb. Provisional value, not directly evidenced for this model.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	—	The bulb has no local account model; control is delegated entirely to the Tapo account and app. Provisional value, not directly evidenced for this model.
Authentication	Basic	🔗 Proof	Authentication exists at the app and protocol level, but CVE-2023-38906 shows sensitive information can be obtained through the authentication code path, so the control is basic rather than secure.
Brute-force protection	Absent	—	No documented lockout or rate limiting, and the practical attacks against this device are protocol-level replay rather than password guessing. Provisional value.
Event logging	Absent	—	The bulb keeps no inspectable local event log; any history lives in the Tapo account. Provisional value, not directly evidenced for this model.
Passwords	Require change after setup	—	There is no per-device password on the bulb; it pairs to the Tapo account with a complexity-checked account password on first setup, hence the require-change-after-setup value rather than a default credential. Provisional value.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded (Tapo firmware) (Companion App: Tapo)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Wi-Fi 2.4 GHz, Bluetooth LE (setup)
Physical (Dimensions & Mass)	Dimensions: • Mass:

The TP-Link Tapo L530E is a Wi-Fi smart bulb with colour control, one of the most widely sold consumer smart lights. Four CVEs name the L530 specifically, all fixed in firmware 1.2.4 and all published in 2023. The most serious is CVE-2023-38907 (CVSS 7.5), a replay flaw: messages encrypted under a still-valid session key can be re-sent by a remote attacker and accepted. The other three (CVE-2023-38906, 38908, 38909, all CVSS 6.5) concern information disclosure through the authentication code, the TSKEP authentication function, and the AES128-CBC IV component. Together they describe a cryptographic design that was shipped without adequate freshness and IV handling rather than a single coding slip. The device is rated D, and the arithmetic matters: Device sums to 1+2+1+2 = 6, averaging 1.5 which rounds up to 2; System sums to 2+2+3 = 7, averaging 2.33 which rounds up to 3; User Authentication sums to 2+2+3+3+2 = 12, averaging 2.4 which rounds up to 3. That gives a GRAS of 8. The rating is not F because none of the four flaws gives unauthenticated full device takeover of the kind seen with CVE-2021-36260 on the Hikvision camera, no exploitation campaign was found, and the physical consequence of a lightbulb compromise is limited to lighting. Values for hardware tampering, prior attacks, storage encryption, account management, brute-force protection, event logging and password policy are provisional because no model-level TP-Link documentation could be retrieved; the rating rests on the four CVE records.