CVE-2023-27098: n/a hardcoded creds bypass login auth

CISO Take

TP-Link's Tapo companion app for smart cameras and plugs ships hardcoded credentials in versions up to 2.12.703, letting anyone who extracts the string from the APK authenticate to the app's login panel without a real password. The flaw is network-exploitable with no privileges or user interaction required (CVSS 7.5), but real-world urgency is limited: EPSS sits at just 0.376% (top 70th percentile, not the high end), it is not in CISA KEV, CISA's SSVC rates it TRACK_STAR (monitor, no immediate action), and no public exploit code or Nuclei scanner template exists. This is a consumer IoT/smart-home app issue, not an AI/ML pipeline vulnerability — it appears in this feed under an 'ml_ui' tag despite having nothing to do with model serving, inference, or AI tooling, likely because Tapo cameras separately market AI-based motion/object detection features unrelated to this specific bug. Organizations that allow TP-Link Tapo devices on corporate or guest networks (e.g., as physical security cameras) should confirm the app is updated past 2.12.703 and keep these devices segmented on an isolated IoT VLAN regardless of patch status.

Sources: NVD EPSS CISA KEV

What is the risk?

Low-to-moderate operational risk. Exploitability is high in principle (AV:N/AC:L/PR:N/UI:N), but exploitation requires the attacker to first reverse-engineer the APK to recover the hardcoded credential string, and there is no evidence of active exploitation. EPSS (0.376%) and SSVC (TRACK_STAR) both indicate low real-world exploitation probability, and the only known PoC is a GitHub write-up rather than weaponized tooling. Impact is confidentiality-only at the login-panel level (C:H/I:N/A:N) — this is not a full device-takeover or data-destruction primitive.

How does the attack unfold?

APK extraction & credential recovery

Attacker downloads the public Tapo APK and decompiles it to recover the hardcoded login credential.

Authentication

Attacker uses the recovered credential to authenticate to the Tapo app's login panel without the legitimate owner's password.

Impact

Attacker gains unauthorized access to the login panel and any device settings or controls exposed behind it.

APK extraction & credential recovery

Attacker downloads the public Tapo APK and decompiles it to recover the hardcoded login credential.

Authentication

Attacker uses the recovered credential to authenticate to the Tapo app's login panel without the legitimate owner's password.

Impact

Attacker gains unauthorized access to the login panel and any device settings or controls exposed behind it.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n/a	—	—	No patch

Do you use n/a? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Update the Tapo app to the latest release via the official app store — TP-Link's fix removes or rotates the hardcoded credential, though no specific patched version is listed in the CVE record, so confirm against TP-Link's support channel. Until confirmed patched, do not rely on the app's login panel as a security boundary, and keep Tapo devices on an isolated IoT/guest network segment separate from corporate assets. Detection is limited since this is a client-side app flaw rather than a network-observable exploit pattern — monitor for unexpected access to device management panels rather than network-based indicators.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass API

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2023-27098?

TP-Link's Tapo companion app for smart cameras and plugs ships hardcoded credentials in versions up to 2.12.703, letting anyone who extracts the string from the APK authenticate to the app's login panel without a real password. The flaw is network-exploitable with no privileges or user interaction required (CVSS 7.5), but real-world urgency is limited: EPSS sits at just 0.376% (top 70th percentile, not the high end), it is not in CISA KEV, CISA's SSVC rates it TRACK_STAR (monitor, no immediate action), and no public exploit code or Nuclei scanner template exists. This is a consumer IoT/smart-home app issue, not an AI/ML pipeline vulnerability — it appears in this feed under an 'ml_ui' tag despite having nothing to do with model serving, inference, or AI tooling, likely because Tapo cameras separately market AI-based motion/object detection features unrelated to this specific bug. Organizations that allow TP-Link Tapo devices on corporate or guest networks (e.g., as physical security cameras) should confirm the app is updated past 2.12.703 and keep these devices segmented on an isolated IoT VLAN regardless of patch status.

Is CVE-2023-27098 actively exploited?

No confirmed active exploitation of CVE-2023-27098 has been reported, but organizations should still patch proactively.

How to fix CVE-2023-27098?

Update the Tapo app to the latest release via the official app store — TP-Link's fix removes or rotates the hardcoded credential, though no specific patched version is listed in the CVE record, so confirm against TP-Link's support channel. Until confirmed patched, do not rely on the app's login panel as a security boundary, and keep Tapo devices on an isolated IoT/guest network segment separate from corporate assets. Detection is limited since this is a client-side app flaw rather than a network-observable exploit pattern — monitor for unexpected access to device management panels rather than network-based indicators.

What is the CVSS score for CVE-2023-27098?

CVE-2023-27098 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.38%.

What are the technical details?

Original Advisory

TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel.

Exploitation Scenario

An attacker downloads the public Tapo APK and decompiles it (as demonstrated in the referenced GitHub PoC) to extract the hardcoded credential used by the app's login panel. With network access to a target's Tapo-connected device or companion API — for example on a shared Wi-Fi or guest network — the attacker uses the recovered credential to authenticate without knowing the device owner's real password, gaining access to whatever settings the login panel exposes. No social engineering or user interaction is needed beyond network proximity to the target device.