TP-Link Tapo App Privilege Escalation Vulnerability on Shared Devices

A privilege escalation vulnerability has been identified in the TP-Link Tapo app for Android, version 3.10.513 and prior. When a low battery notification is received on a shared device, tapping the notification allows the user to access and modify the device's power settings. This issue arises because the notification system bundles various alerts together, creating a potential oversight in managing critical device settings.

Impact

Exploitation of this vulnerability allows a user with limited privileges to gain full access to the power settings of a shared device.

Remediation

Users are advised to update to the latest version of the TP-Link Tapo app for Android, version 3.10.513 or above, to address this vulnerability.