The Tapo Cloud MQTT broker contains a broken access control flaw on a proxy topic that authenticated devices use to request service tokens. Because the broker does not confirm that the device ID supplied in the request matches the authenticated device, an attacker who owns a Tapo device and knows another device’s ID can obtain a token scoped to the target device. With that token the attacker can upload attacker‑controlled content that will appear as a legitimate event in the target user’s Tapo app, or issue crafted proxy requests to retrieve internal service information or disrupt service availability.

TP‑Link Tapo Cloud Service is affected. Any device using the Tapo Cloud MQTT broker that supports the vulnerable proxy topic is at risk, particularly those firmware builds that have not applied the vendor’s fix.

The CVSS score of 8.3 indicates a high severity, with potential for significant confidentiality, integrity, and availability impact. The EPSS score is not available, so the exploitation probability is unclear, and the vulnerability is not listed in the CISA KEV catalog. Likely, the attacker must own a legitimate Tapo device and know another device’s identifier; the attack is conducted via MQTT, a remote protocol, so no special network connectivity beyond the cloud connection is required.