Read the docs
TI-2026-53646 Aliases CVE-2026-76784GHSA-pfwg-rgvf-86xw

Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple…

Priority LOW 39CWE-325Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful exploitation could allow an attacker to manipulate the operational state of an affected device, resulting in unauthorized state changes, disruption of normal device functionality or a denial-of-service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00197 9th percentileScored 2026-11-07
Fix Fixed HS103P3 / HS103P4 v5 (TP-Link Systems Inc.): 1.1.3 Build 250908 Rel.112508EP10 (TP-Link Systems Inc.): 1.1.1 Build 250908 Rel.112508+18 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkHS103P3 / HS103P4 v5before 1.1.3 Build 250908 Rel.1125081.1.3 Build 250908 Rel.112508Patch availableCNA
TP-LinkEP10before 1.1.1 Build 250908 Rel.1125081.1.1 Build 250908 Rel.112508Patch availableCNA
TP-LinkEP25 V2before 1.0.3 Build 240529 Rel.1452521.0.3 Build 240529 Rel.145252Patch availableCNA
TP-LinkHS300 V2before 1.1.2 Build 241220 Rel.1713331.1.2 Build 241220 Rel.171333Patch availableCNA
TP-LinkKP303 V2before 1.1.2 Build 241220 Rel.1733211.1.2 Build 241220 Rel.173321Patch availableCNA
TP-LinkEP40Abefore 1.1.1 Build 250908 Rel.1125261.1.1 Build 250908 Rel.112526Patch availableCNA
TP-LinkKP125MP2 / KP125MP4before 1.2.5 Build 241213 Rel.1725041.2.5 Build 241213 Rel.172504Patch availableCNA
TP-LinkKP115before 1.1.1 Build 250908 Rel.1129451.1.1 Build 250908 Rel.112945Patch availableCNA
TP-LinkKS225before 1.1.1 Build 240626 Rel.1751251.1.1 Build 240626 Rel.175125Patch availableCNA
TP-LinkEP40Mbefore 1.1.0 Build 240415 Rel.1712191.1.0 Build 240415 Rel.171219Patch availableCNA
TP-LinkKS205before 1.1.1 Build 240724 Rel.1059201.1.1 Build 240724 Rel.105920Patch availableCNA
TP-LinkKS240before 1.0.6 Build 240122 Rel.1601001.0.6 Build 240122 Rel.160100Patch availableCNA
TP-LinkES20Mbefore 1.1.6 Build 250522 Rel.2102541.1.6 Build 250522 Rel.210254Patch availableCNA
TP-LinkKS220Mbefore 1.1.6 Build 250522 Rel.2102541.1.6 Build 250522 Rel.210254Patch availableCNA
TP-LinkKP200 V3before 1.1.0 Build 250225 Rel.1717241.1.0 Build 250225 Rel.171724Patch availableCNA
TP-LinkHS200 V5.26before 1.0.3 Build 240723 Rel.1926221.0.3 Build 240723 Rel.192622Patch availableCNA
TP-LinkHS220-LA(US) 6.6 / HS220-BL(US) 6.6before 1.0.3 Build 240723 Rel.1926301.0.3 Build 240723 Rel.192630Patch availableCNA
TP-LinkHS220 V3.26before 1.1.1 Build 240802 Rel.0941311.1.1 Build 240802 Rel.094131Patch availableCNA
TP-LinkHS220-LA(US) 4.6 / HS220-BL(US) 4.6before 1.1.1 Build 240802 Rel.0941421.1.1 Build 240802 Rel.094142Patch availableCNA
TP-LinkKL125before 1.1.1 Build 260710 Rel.0826461.1.1 Build 260710 Rel.082646Patch availableCNA
  • HS103P3 / HS103P4 v5 VendorTP-Link Affected before 1.1.3 Build 250908 Rel.112508 Fixed in 1.1.3 Build 250908 Rel.112508 Patch available CNA
  • EP10 VendorTP-Link Affected before 1.1.1 Build 250908 Rel.112508 Fixed in 1.1.1 Build 250908 Rel.112508 Patch available CNA
  • EP25 V2 VendorTP-Link Affected before 1.0.3 Build 240529 Rel.145252 Fixed in 1.0.3 Build 240529 Rel.145252 Patch available CNA
  • HS300 V2 VendorTP-Link Affected before 1.1.2 Build 241220 Rel.171333 Fixed in 1.1.2 Build 241220 Rel.171333 Patch available CNA
  • KP303 V2 VendorTP-Link Affected before 1.1.2 Build 241220 Rel.173321 Fixed in 1.1.2 Build 241220 Rel.173321 Patch available CNA
  • EP40A VendorTP-Link Affected before 1.1.1 Build 250908 Rel.112526 Fixed in 1.1.1 Build 250908 Rel.112526 Patch available CNA
  • KP125MP2 / KP125MP4 VendorTP-Link Affected before 1.2.5 Build 241213 Rel.172504 Fixed in 1.2.5 Build 241213 Rel.172504 Patch available CNA
  • KP115 VendorTP-Link Affected before 1.1.1 Build 250908 Rel.112945 Fixed in 1.1.1 Build 250908 Rel.112945 Patch available CNA
  • KS225 VendorTP-Link Affected before 1.1.1 Build 240626 Rel.175125 Fixed in 1.1.1 Build 240626 Rel.175125 Patch available CNA
  • EP40M VendorTP-Link Affected before 1.1.0 Build 240415 Rel.171219 Fixed in 1.1.0 Build 240415 Rel.171219 Patch available CNA
  • KS205 VendorTP-Link Affected before 1.1.1 Build 240724 Rel.105920 Fixed in 1.1.1 Build 240724 Rel.105920 Patch available CNA
  • KS240 VendorTP-Link Affected before 1.0.6 Build 240122 Rel.160100 Fixed in 1.0.6 Build 240122 Rel.160100 Patch available CNA
  • ES20M VendorTP-Link Affected before 1.1.6 Build 250522 Rel.210254 Fixed in 1.1.6 Build 250522 Rel.210254 Patch available CNA
  • KS220M VendorTP-Link Affected before 1.1.6 Build 250522 Rel.210254 Fixed in 1.1.6 Build 250522 Rel.210254 Patch available CNA
  • KP200 V3 VendorTP-Link Affected before 1.1.0 Build 250225 Rel.171724 Fixed in 1.1.0 Build 250225 Rel.171724 Patch available CNA
  • HS200 V5.26 VendorTP-Link Affected before 1.0.3 Build 240723 Rel.192622 Fixed in 1.0.3 Build 240723 Rel.192622 Patch available CNA
  • HS220-LA(US) 6.6 / HS220-BL(US) 6.6 VendorTP-Link Affected before 1.0.3 Build 240723 Rel.192630 Fixed in 1.0.3 Build 240723 Rel.192630 Patch available CNA
  • HS220 V3.26 VendorTP-Link Affected before 1.1.1 Build 240802 Rel.094131 Fixed in 1.1.1 Build 240802 Rel.094131 Patch available CNA
  • HS220-LA(US) 4.6 / HS220-BL(US) 4.6 VendorTP-Link Affected before 1.1.1 Build 240802 Rel.094142 Fixed in 1.1.1 Build 240802 Rel.094142 Patch available CNA
  • KL125 VendorTP-Link Affected before 1.1.1 Build 260710 Rel.082646 Fixed in 1.1.1 Build 260710 Rel.082646 Patch available CNA

Remediation

  • Fix · CNA HS103P3 / HS103P4 v5 (TP-Link Systems Inc.) Fixed in 1.1.3 Build 250908 Rel.112508
  • Fix · CNA EP10 (TP-Link Systems Inc.) Fixed in 1.1.1 Build 250908 Rel.112508
  • Fix · CNA EP25 V2 (TP-Link Systems Inc.) Fixed in 1.0.3 Build 240529 Rel.145252
  • Fix · CNA HS300 V2 (TP-Link Systems Inc.) Fixed in 1.1.2 Build 241220 Rel.171333
  • Fix · CNA KP303 V2 (TP-Link Systems Inc.) Fixed in 1.1.2 Build 241220 Rel.173321
  • Fix · CNA EP40A (TP-Link Systems Inc.) Fixed in 1.1.1 Build 250908 Rel.112526
  • Fix · CNA KP125MP2 / KP125MP4 (TP-Link Systems Inc.) Fixed in 1.2.5 Build 241213 Rel.172504
  • Fix · CNA KP115 (TP-Link Systems Inc.) Fixed in 1.1.1 Build 250908 Rel.112945
  • Fix · CNA KS225 (TP-Link Systems Inc.) Fixed in 1.1.1 Build 240626 Rel.175125
  • Fix · CNA EP40M (TP-Link Systems Inc.) Fixed in 1.1.0 Build 240415 Rel.171219
  • Fix · CNA KS205 (TP-Link Systems Inc.) Fixed in 1.1.1 Build 240724 Rel.105920
  • Fix · CNA KS240 (TP-Link Systems Inc.) Fixed in 1.0.6 Build 240122 Rel.160100
  • Fix · CNA ES20M (TP-Link Systems Inc.) Fixed in 1.1.6 Build 250522 Rel.210254
  • Fix · CNA KS220M (TP-Link Systems Inc.) Fixed in 1.1.6 Build 250522 Rel.210254
  • Fix · CNA KP200 V3 (TP-Link Systems Inc.) Fixed in 1.1.0 Build 250225 Rel.171724
  • Fix · CNA HS200 V5.26 (TP-Link Systems Inc.) Fixed in 1.0.3 Build 240723 Rel.192622
  • Fix · CNA HS220-LA(US) 6.6 / HS220-BL(US) 6.6 (TP-Link Systems Inc.) Fixed in 1.0.3 Build 240723 Rel.192630
  • Fix · CNA HS220 V3.26 (TP-Link Systems Inc.) Fixed in 1.1.1 Build 240802 Rel.094131
  • Fix · CNA HS220-LA(US) 4.6 / HS220-BL(US) 4.6 (TP-Link Systems Inc.) Fixed in 1.1.1 Build 240802 Rel.094142
  • Fix · CNA KL125 (TP-Link Systems Inc.) Fixed in 1.1.1 Build 260710 Rel.082646

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76784
  2. 2026-10-03 Alias added: GHSA-pfwg-rgvf-86xw

References

Patch 3

Advisory 1

  • TI-2023-16571 TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain… KEVCVSS 3.1HIGH 8.8
  • TI-2023-01313 Command injection in TP-Link Archer AX21 KEVCVSS 3.1HIGH 8.8
  • TI-2020-14907 TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the… KEVCVSS 3.1HIGH 8.8
  • TI-2025-08589 Authenticated RCE via Parental Control command injection KEVCVSS 4.0HIGH 8.6
  • TI-2015-02672 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317… KEVCVSS 3.1HIGH 7.5
  • TI-2023-27456 Authentication bypass by spoofing in TP-Link TL-WR841N KEVCVSS 3.1MEDIUM 6.5
See all 636 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences