Riskcovery

CVE-2026-76784

Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices

State
Published
Severity
8.7 High
Published
Aug 26, 2026
Updated
Aug 26, 2026
Reserved
Aug 19, 2026

Read the record on cve.org

Description

Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control.

Successful exploitation could allow an attacker to manipulate the operational state of an affected device, resulting in unauthorized state changes, disruption of normal device functionality or a denial-of-service condition.

Scores

CVSSScoreVectorSource
4.08.7 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NTPLink

Weaknesses

Affected Products

ProductVersions
HS103P3 / HS103P4 v5TP-Link Systems Inc.
  • before 1.1.3 Build 250908 Rel.112508Affected
EP10TP-Link Systems Inc.
  • before 1.1.1 Build 250908 Rel.112508Affected
EP25 V2TP-Link Systems Inc.
  • before 1.0.3 Build 240529 Rel.145252Affected
HS300 V2TP-Link Systems Inc.
  • before 1.1.2 Build 241220 Rel.171333Affected
KP303 V2TP-Link Systems Inc.
  • before 1.1.2 Build 241220 Rel.173321Affected
EP40ATP-Link Systems Inc.
  • before 1.1.1 Build 250908 Rel.112526Affected
KP125MP2 / KP125MP4TP-Link Systems Inc.
  • before 1.2.5 Build 241213 Rel.172504Affected
KP115TP-Link Systems Inc.
  • before 1.1.1 Build 250908 Rel.112945Affected
KS225TP-Link Systems Inc.
  • before 1.1.1 Build 240626 Rel.175125Affected
EP40MTP-Link Systems Inc.
  • before 1.1.0 Build 240415 Rel.171219Affected
KS205TP-Link Systems Inc.
  • before 1.1.1 Build 240724 Rel.105920Affected
KS240TP-Link Systems Inc.
  • before 1.0.6 Build 240122 Rel.160100Affected
ES20MTP-Link Systems Inc.
  • before 1.1.6 Build 250522 Rel.210254Affected
KS220MTP-Link Systems Inc.
  • before 1.1.6 Build 250522 Rel.210254Affected
KP200 V3TP-Link Systems Inc.
  • before 1.1.0 Build 250225 Rel.171724Affected
HS200 V5.26TP-Link Systems Inc.
  • before 1.0.3 Build 240723 Rel.192622Affected
HS220-LA(US) 6.6 / HS220-BL(US) 6.6TP-Link Systems Inc.
  • before 1.0.3 Build 240723 Rel.192630Affected
HS220 V3.26TP-Link Systems Inc.
  • before 1.1.1 Build 240802 Rel.094131Affected
HS220-LA(US) 4.6 / HS220-BL(US) 4.6TP-Link Systems Inc.
  • before 1.1.1 Build 240802 Rel.094142Affected
KL125TP-Link Systems Inc.
  • before 1.1.1 Build 260710 Rel.082646Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.