Improper Authentication Vulnerability in Kasa Smart Devices by TP-Link
CVE-2026-108473

8.7HIGH

Key Information:

Vendor

Tp-link Systems Inc.

Status
Hs103 V5
Ep10 V1
Ep40 V1
Hs200 V5
Vendor
CVE Published:
14 October 2026

What is CVE-2026-108473?

Kasa smart devices from TP-Link exhibit an improper authentication flaw in their local device-management protocol. This vulnerability enables an unauthenticated adjacent attacker to send management commands, potentially altering device settings or state without proper authorization. Additionally, under specific usage scenarios, interactions between the user, mobile app, and cloud service may lead to insufficient safeguarding of account-related communications, risking exposure of sensitive account information. Successful exploitation of this weakness allows unauthorized management actions and disrupts legitimate user control, with possible consequences for cloud account security.

Affected Version(s)

EP10 v1 0 < 1.1.1 Build 250908 Rel.112508

EP40 v1 0 < 1.1.0 Build 250225 Rel.171723

EP40A v1 0 < 1.1.1 Build 250908 Rel.112526

References

https://www.tp-link.com/us/support/download/
patch
https://www.tp-link.com/en/support/download/
patch
https://www.tp-link.com/us/support/faq/5342/
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

M. Hammad Mazhar from University of Northern Colorado & Madeline Cooreman
.