CVE-2026-108473
Deferred Deferred - Pending Action

Authentication Bypass in Kasa Smart Devices

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: TPLink

Description
Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state or management settings. Under certain usage conditions involving interaction between the user, mobile application, and device-cloud service, insufficient protection of account-related communications may also expose account information. Successful exploitation may allow an unauthenticated adjacent-network attacker to perform unauthorized device-management actions and disrupt legitimate user control. Under certain conditions, account-related information may also be exposed, potentially leading to compromise of the associated cloud account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-14
EPSS Evaluated
2026-10-18
NVD
CVE-2026-108473
EUVD
EUVD-2026-100759

Affected Vendors & Products

Showing 24 associated CPEs
Vendor Product Version / Range
TP-Link Systems Inc. HS103 v5 0
TP-Link Systems Inc. EP10 v1 0
TP-Link Systems Inc. EP40 v1 0
TP-Link Systems Inc. HS200 v5 0
TP-Link Systems Inc. KP401 v1 0
TP-Link Systems Inc. KS230 KIT v2 0
TP-Link Systems Inc. KP405 v1 0
TP-Link Systems Inc. HS220 v3 0
TP-Link Systems Inc. KP115 v1 0
TP-Link Systems Inc. HS210 v3 0
TP-Link Systems Inc. HS300 v2 0
TP-Link Systems Inc. KP200 v3 0
TP-Link Systems Inc. KP303 v2 0
TP-Link Systems Inc. KS200 v1 0
TP-Link Systems Inc. EP40A v1 0
TP-Link Systems Inc. KS220 v1 0
TP-Link Systems Inc. KS200M v1 0
TP-Link Systems Inc. ES20M v1 0
TP-Link Systems Inc. KS220M v1 0
TP-Link Systems Inc. KP400 v3 0
TP-Link Systems Inc. KL125 v4 0
TP-Link Systems Inc. KL135 v2 0
TP-Link Systems Inc. KL110 v4 0
TP-Link Systems Inc. KL420L5 v1 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper authentication issue in multiple TP-Link Kasa smart home devices. An attacker within the same network can send unauthorized commands to these devices without proper authentication, potentially changing their settings or state. In some cases, weak protection of account communications may also expose sensitive user information, risking cloud account compromise.

Detection Guidance

Detecting this vulnerability requires checking if your TP-Link Kasa devices are running outdated firmware versions. Use network scanning tools like nmap to identify affected devices by their model numbers listed in the CVE. Verify firmware versions via the Kasa app or by accessing the device's web interface. Look for devices with firmware versions prior to the latest updates provided by TP-Link.

Impact Analysis

An attacker could take control of your smart devices, turning them on or off without your permission. They might also access your account information, potentially leading to further compromise of your cloud account or other connected services.

Compliance Impact

This vulnerability may expose account-related information, potentially leading to unauthorized access to user data. This could violate GDPR requirements for data protection and user consent, as well as HIPAA rules for safeguarding sensitive health information if such data is compromised through affected devices.

Mitigation Strategies

Immediately update all affected TP-Link Kasa devices to the latest firmware versions provided by TP-Link. Disable remote access if not required and ensure strong, unique passwords for both device and cloud accounts. Monitor device behavior for unauthorized changes and isolate compromised devices from the network if exploitation is suspected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108473. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart