Authentication vulnerability in TP-Link Kasa devices exploitable from the local network

TP-Link has disclosed an authentication flaw affecting its Kasa smart plugs, switches, dimmers, and bulbs. The issue, registered as CVE-2026-108473, stems from insufficient authentication and authorization in the devices’ local management protocol. An attacker on the same local network can send management commands to a device without requiring a username or password.

Device control and account details at risk

According to TP-Link’s advisory, a successful attack can let someone change the device status and management settings without permission, and disrupt the user’s control over the device. Under certain usage conditions, account details may also be exposed, which could lead to takeover of the cloud account the device is linked to. The vulnerability has a CVSS v4.0 score of 8.7, and its vector points to exploitation over an adjacent network (AV:A); the attack requires no user interaction or special privileges. Neither the NVD nor TP-Link records indicate that the flaw is being actively exploited.

Which products are affected

The list in the advisory is quite broad. On the plug and switch side, it includes the HS103, HS200, HS210, HS220, HS300, KP115, KP200, KP303, KP400, KP401, KP405, KS200, KS220, KS230 KIT, plus the EP10, EP40, EP40A, and ES20M/KS220M models. In the bulb and strip group, the KL110, KL125, KL135, and KL420L5 are listed. The flaw covers multiple hardware revisions; TP-Link lists the affected hardware revision and the firmware version containing the fix for each model in the advisory table. For example, the fixed version is given as 1.1.3 Build 250908 for the HS103 V5, 1.1.2 Build 241220 for the HS300 V2, and 1.1.1 Build 260710 for the KL125 V4.

What you should do

TP-Link recommends updating the firmware on affected devices and says to follow the instructions in its download center. The update is done by selecting the relevant model and hardware revision; the advisory provides the target firmware version for each model separately. Because the attack comes from the local network, keeping devices separate from guest networks and shared Wi-Fi networks is a practical way to reduce risk until the update is applied.

Source: TP-Link Security Advisory · NVD