CVE-2024-31340

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-31340
TP-Link Tether versions prior to 4.5.13 and TP-Link Tapo versions prior to 3.3.6 do not properly validate certificates, which may allow a remote unauthenticated attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://jvn.jp/en/jp/JVN29471697/
https://play.google.com/store/apps/details?id=com.tplink.iot
https://play.google.com/store/apps/details?id=com.tplink.tether
https://jvn.jp/en/jp/JVN29471697/
https://play.google.com/store/apps/details?id=com.tplink.iot
https://play.google.com/store/apps/details?id=com.tplink.tether
Configurations

No configuration.

History

28 Mar 2025, 20:15

Type Values Removed Values Added
CWE CWE-295

21 Nov 2024, 09:13

Type Values Removed Values Added
References () https://jvn.jp/en/jp/JVN29471697/ - () https://jvn.jp/en/jp/JVN29471697/ -
References () https://play.google.com/store/apps/details?id=com.tplink.iot - () https://play.google.com/store/apps/details?id=com.tplink.iot -
References () https://play.google.com/store/apps/details?id=com.tplink.tether - () https://play.google.com/store/apps/details?id=com.tplink.tether -

03 Jul 2024, 01:54

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.8
Summary
  • (es) Las versiones de TP-Link Tether anteriores a 4.5.13 y las versiones de TP-Link Tapo anteriores a 3.3.6 no validan correctamente los certificados, lo que puede permitir que un atacante remoto no autenticado escuche a escondidas una comunicación cifrada a través de un ataque de intermediario.

22 May 2024, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-22 06:15

Updated : 2025-03-28 20:15

NVD link : CVE-2024-31340

Mitre link : CVE-2024-31340

CVE.ORG link : CVE-2024-31340

JSON object : View

Products Affected

No product.

CWE
CWE-295

Improper Certificate Validation