A popular TP-Link smart light bulb has been found to have serious security flaws that could potentially expose users' passwords and other sensitive information, according to researchers. The vulnerabilities were discovered in the TP-Link Tapo L530E, a best-selling smart bulb that is compatible with Apple's HomeKit platform.

The researchers conducted a Vulnerability Assessment and Penetration Testing (VAPT) using the PETIoT kill chain methodology, and identified four critical bugs in the TP-Link smart bulb:

1. A serious bug related to a lack of authentication in the companion smartphone app, allowing unauthorized access.
2. A serious bug related to a hard-coded and insufficiently long secret shared between the app and the smart bulb.
3. A medium severity vulnerability stemming from a lack of randomness in symmetric encryption.
4. A medium severity vulnerability that, when combined with the above bug, could lead to denial-of-service attacks.

These vulnerabilities could potentially allow hackers to impersonate the smart bulb, gain access to other Tapo devices connected to the same account, and even obtain the user's Wi-Fi password.

TP-Link has been notified of the findings and plans to release firmware updates to address the issues, although no specific timeline has been provided. Experts have highlighted the importance of ensuring the security of smart devices, as they can serve as entry points for malicious actors to compromise other connected devices within the home.

As the number of smart devices continues to grow, so does the potential for security flaws to spread and pose a greater risk to users' privacy and data security.