TP-Link Kasa devices: Improper authentication in local device-management protocol
Summary
Multiple TP-Link Kasa smart-home devices accept management instructions over the local device-management protocol without adequate authentication or authorization. An unauthenticated attacker on the same network segment (LAN, Wi-Fi or a compromised device) can change device state or management settings. Under certain conditions involving the mobile app and device-cloud service, account-related information may also be exposed, potentially leading to compromise of the linked cloud account. The CVSS v4.0 base score is 8.7 (High).
Affected
- HS103 v5: versions before 1.1.3 Build 250908 Rel.112508
- EP10 v1: versions before 1.1.1 Build 250908 Rel.112508
- EP40 v1: versions before 1.1.0 Build 250225 Rel.171723
- HS200 v5: versions before 1.1.2 Build 241220 Rel.165559
- KP401 v1: versions before 1.1.2 Build 241223 Rel.094434
- KS230 KIT v2: versions before 1.1.4 Build 241223 Rel.105830
- KP405 v1: versions before 1.1.0 Build 250225 Rel.174632
- HS220 v3: versions before 1.1.4 Build 241220 Rel.171050
- KP115 v1: versions before 1.1.1 Build 250908 Rel.112945
- HS210 v3: versions before 1.1.0 Build 250225 Rel.163425
- HS300 v2: versions before 1.1.2 Build 241220 Rel.171333
- KP200 v3: versions before 1.1.0 Build 250225 Rel.171724
- KP303 v2: versions before 1.1.2 Build 241220 Rel.173321
- KS200 v1: versions before 1.1.2 Build 241223 Rel.103857
- EP40A v1: versions before 1.1.1 Build 250908 Rel.112526
Source: CVE record (CNA: TP-Link). Versions to be checked against TP-Link FAQ 5342.
Fixed in
- Update to the fixed firmware listed for each model, i.e. the first version after the affected range:
- HS103 v5: 1.1.3 Build 250908 Rel.112508 or later
- EP10 v1: 1.1.1 Build 250908 Rel.112508 or later
- EP40 v1: 1.1.0 Build 250225 Rel.171723 or later
- HS200 v5: 1.1.2 Build 241220 Rel.165559 or later
- KP401 v1: 1.1.2 Build 241223 Rel.094434 or later
- KS230 KIT v2: 1.1.4 Build 241223 Rel.105830 or later
- KP405 v1: 1.1.0 Build 250225 Rel.174632 or later
- HS220 v3: 1.1.4 Build 241220 Rel.171050 or later
- KP115 v1: 1.1.1 Build 250908 Rel.112945 or later
- HS210 v3: 1.1.0 Build 250225 Rel.163425 or later
- HS300 v2: 1.1.2 Build 241220 Rel.171333 or later
- KP200 v3: 1.1.0 Build 250225 Rel.171724 or later
- KP303 v2: 1.1.2 Build 241220 Rel.173321 or later
- KS200 v1: 1.1.2 Build 241223 Rel.103857 or later
- EP40A v1: 1.1.1 Build 250908 Rel.112526 or later
Workaround
- No vendor workaround published. The vendor remedy is the firmware update.
- Until patched, place Kasa devices on a separate IoT VLAN or guest network, away from the main LAN and business-critical systems (general practice, not from the vendor).
- Block untrusted devices from reaching Kasa devices on the local network.
Exploitation
- No evidence of active exploitation found; no CISA KEV entry found at the time of research.
- No public proof-of-concept found; this does not prove that none exists.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS of 0.00275 is provisional for this newly published CVE.
Our recommendation
- Inventory all Kasa devices and check each model and firmware version against TP-Link FAQ 5342.
- Update affected devices to the fixed firmware promptly.
- Isolate Kasa devices on an IoT VLAN or guest network until patched.
- Use a unique, strong password and multi-factor authentication for the linked TP-Link cloud account.
- Note: newer firmware may stop Home Assistant control until Third-Party Compatibility is enabled in the Kasa app.
- Recheck CISA KEV and public exploit sources in the coming weeks.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TP-Link Security Advisory FAQ 5342 www.tp-link.com
- TP-Link Download Center (US) www.tp-link.com
- TP-Link Download Center (EN) www.tp-link.com
- Vulners CVE-2026-108473 vulners.com
- Strix CVE-2026-108473 www.strix.ai
- CVE Threat Intelligence CVE-2026-108473 cve.threatint.com
- python-kasa GitHub issue 1827 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:12.
Original description (NVD)
Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state or management settings. Under certain usage conditions involving interaction between the user, mobile application, and device-cloud service, insufficient protection of account-related communications may also expose account information. Successful exploitation may allow an unauthenticated adjacent-network attacker to perform unauthorized device-management actions and disrupt legitimate user control. Under certain conditions, account-related information may also be exposed, potentially leading to compromise of the associated cloud account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.