CVE-2026-108473

Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices

State: Published
Severity: 8.7 High
Published: Oct 14, 2026
Updated: Oct 14, 2026
Reserved: Oct 9, 2026

Description

Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state or management settings. Under certain usage conditions involving interaction between the user, mobile application, and device-cloud service, insufficient protection of account-related communications may also expose account information.

Successful exploitation may allow an unauthenticated adjacent-network attacker to perform unauthorized device-management actions and disrupt legitimate user control. Under certain conditions, account-related information may also be exposed, potentially leading to compromise of the associated cloud account.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	TPLink

Weaknesses

CWE-306 Missing authentication for critical function

Affected Products

Product	Versions
HS103 v5TP-Link Systems Inc.	before 1.1.3 Build 250908 Rel.112508Affected
EP10 v1TP-Link Systems Inc.	before 1.1.1 Build 250908 Rel.112508Affected
EP40 v1TP-Link Systems Inc.	before 1.1.0 Build 250225 Rel.171723Affected
HS200 v5TP-Link Systems Inc.	before 1.1.2 Build 241220 Rel.165559Affected
KP401 v1TP-Link Systems Inc.	before 1.1.2 Build 241223 Rel.094434Affected
KS230 KIT v2TP-Link Systems Inc.	before 1.1.4 Build 241223 Rel.105830Affected
KP405 v1TP-Link Systems Inc.	before 1.1.0 Build 250225 Rel.174632Affected
HS220 v3TP-Link Systems Inc.	before 1.1.4 Build 241220 Rel.171050Affected
KP115 v1TP-Link Systems Inc.	before 1.1.1 Build 250908 Rel.112945Affected
HS210 v3TP-Link Systems Inc.	before 1.1.0 Build 250225 Rel.163425Affected
HS300 v2TP-Link Systems Inc.	before 1.1.2 Build 241220 Rel.171333Affected
KP200 v3TP-Link Systems Inc.	before 1.1.0 Build 250225 Rel.171724Affected
KP303 v2TP-Link Systems Inc.	before 1.1.2 Build 241220 Rel.173321Affected
KS200 v1TP-Link Systems Inc.	before 1.1.2 Build 241223 Rel.103857Affected
EP40A v1TP-Link Systems Inc.	before 1.1.1 Build 250908 Rel.112526Affected
KS220 v1TP-Link Systems Inc.	before 1.1.3 Build 241223 Rel.105515Affected
KS200M v1TP-Link Systems Inc.	before 1.1.4 Build 241223 Rel.104700Affected
ES20M v1TP-Link Systems Inc.	before 1.1.6 Build 250522 Rel.210254Affected
KS220M v1TP-Link Systems Inc.	before 1.1.6 Build 250522 Rel.210254Affected
KP400 v3TP-Link Systems Inc.	before 1.1.0 Build 250225 Rel.171723Affected
KL125 v4TP-Link Systems Inc.	before 1.1.1 Build 260710 Rel.082646Affected
KL135 v2TP-Link Systems Inc.	before 1.1.1 Build 260710 Rel.082646Affected
KL110 v4TP-Link Systems Inc.	before 1.1.1 Build 260710 Rel.082646Affected
KL420L5 v1TP-Link Systems Inc.	before 1.4.2 Build 260605 Rel.035033Affected

References

https://www.tp-link.com/us/support/download/patch
https://www.tp-link.com/en/support/download/patch
https://www.tp-link.com/us/support/faq/5342/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.