CVE-2026-108473: Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices
Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state or management settings. Under certain usage conditions involving interaction between the user, mobile application, and device-cloud service, insufficient protection of account-related communications may also expose account information.
Successful exploitation may allow an unauthenticated adjacent-network attacker to perform unauthorized device-management actions and disrupt legitimate user control. Under certain conditions, account-related information may also be exposed, potentially leading to compromise of the associated cloud account.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the device-management weakness?
An unauthenticated attacker on an adjacent network can send management instructions to an affected device. The issue does not describe exploitation from an arbitrary remote network.
What could an attacker do through the local protocol?
An attacker may modify device state or management settings and disrupt legitimate user control. The described impact is unauthorized device-management action without adequate authentication or authorization.
When is cloud account information at risk?
Account-related information may be exposed only under certain usage conditions involving interaction among the user, mobile application, and device-cloud service. The available information does not specify those conditions or identify affected device models.
What should be done if an affected device cannot be updated immediately?
The provided information establishes that adjacent-network access is required for the local management attack. Restricting untrusted devices from the network segment that can reach the Kasa device can reduce exposure while checking TP-Link support downloads and the referenced support guidance for updates.