CVE-2026-108473
Received
Received - Intake
Authentication Bypass in Kasa Smart Devices
Vulnerability report for CVE-2026-108473, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-14
Last updated on: 2026-10-14
Assigner: TPLink
Description
Description
Multiple
Kasa devices contain an improper authentication vulnerability in the local
device-management protocol. An unauthenticated adjacent attacker may send
management instructions to an affected device without adequate authentication
or authorization, allowing modification of the device state or management
settings. Under certain usage conditions involving interaction between the
user, mobile application, and device-cloud service, insufficient protection of
account-related communications may also expose account information.
Successful
exploitation may allow an unauthenticated adjacent-network attacker to perform
unauthorized device-management actions and disrupt legitimate user control.
Under certain conditions, account-related information may also be exposed,
potentially leading to compromise of the associated cloud account.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| TP-Link | Systems | Inc. HS103 v5 0 |
| TP-Link | Systems | Inc. EP10 v1 0 |
| TP-Link | Systems | Inc. EP40 v1 0 |
| TP-Link | Systems | Inc. HS200 v5 0 |
| TP-Link | Systems | Inc. KP401 v1 0 |
| TP-Link | Systems | Inc. KS230 KIT v2 0 |
| TP-Link | Systems | Inc. KP405 v1 0 |
| TP-Link | Systems | Inc. HS220 v3 0 |
| TP-Link | Systems | Inc. KP115 v1 0 |
| TP-Link | Systems | Inc. HS210 v3 0 |
| TP-Link | Systems | Inc. HS300 v2 0 |
| TP-Link | Systems | Inc. KP200 v3 0 |
| TP-Link | Systems | Inc. KP303 v2 0 |
| TP-Link | Systems | Inc. KS200 v1 0 |
| TP-Link | Systems | Inc. EP40A v1 0 |
| TP-Link | Systems | Inc. KS220 v1 0 |
| TP-Link | Systems | Inc. KS200M v1 0 |
| TP-Link | Systems | Inc. ES20M v1 0 |
| TP-Link | Systems | Inc. KS220M v1 0 |
| TP-Link | Systems | Inc. KP400 v3 0 |
| TP-Link | Systems | Inc. KL125 v4 0 |
| TP-Link | Systems | Inc. KL135 v2 0 |
| TP-Link | Systems | Inc. KL110 v4 0 |
| TP-Link | Systems | Inc. KL420L5 v1 0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
