Read the docs
TI-2026-73858 Aliases CVE-2026-108473GHSA-jmmx-r2fg-mcgh

Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices

Priority LOW 39CWE-306Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

TP-Link Kasa devices such as HS103 v5 and EP10 v1, and other models, lack authentication in their local device-management protocol. Missing authentication (CWE-306) lets an unauthenticated adjacent attacker change device state or management settings and disrupt legitimate user control. Under certain usage conditions, account-related information may be exposed, potentially leading to compromise of the associated cloud account.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state or management settings. Under certain usage conditions involving interaction between the user, mobile application, and device-cloud service, insufficient protection of account-related communications may also expose account information. Successful exploitation may allow an unauthenticated adjacent-network attacker to perform unauthorized device-management actions and disrupt legitimate user control. Under certain conditions, account-related information may also be exposed, potentially leading to compromise of the associated cloud account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00275 19th percentileScored 2026-11-07
Fix Fixed HS103 v5 (TP-Link Systems Inc.): 1.1.3 Build 250908 Rel.112508EP10 v1 (TP-Link Systems Inc.): 1.1.1 Build 250908 Rel.112508+22 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkHS103 v5before 1.1.3 Build 250908 Rel.1125081.1.3 Build 250908 Rel.112508Patch availableCNA
TP-LinkEP10 v1before 1.1.1 Build 250908 Rel.1125081.1.1 Build 250908 Rel.112508Patch availableCNA
TP-LinkEP40 v1before 1.1.0 Build 250225 Rel.1717231.1.0 Build 250225 Rel.171723Patch availableCNA
TP-LinkHS200 v5before 1.1.2 Build 241220 Rel.1655591.1.2 Build 241220 Rel.165559Patch availableCNA
TP-LinkKP401 v1before 1.1.2 Build 241223 Rel.0944341.1.2 Build 241223 Rel.094434Patch availableCNA
TP-LinkKS230 KIT v2before 1.1.4 Build 241223 Rel.1058301.1.4 Build 241223 Rel.105830Patch availableCNA
TP-LinkKP405 v1before 1.1.0 Build 250225 Rel.1746321.1.0 Build 250225 Rel.174632Patch availableCNA
TP-LinkHS220 v3before 1.1.4 Build 241220 Rel.1710501.1.4 Build 241220 Rel.171050Patch availableCNA
TP-LinkKP115 v1before 1.1.1 Build 250908 Rel.1129451.1.1 Build 250908 Rel.112945Patch availableCNA
TP-LinkHS210 v3before 1.1.0 Build 250225 Rel.1634251.1.0 Build 250225 Rel.163425Patch availableCNA
TP-LinkHS300 v2before 1.1.2 Build 241220 Rel.1713331.1.2 Build 241220 Rel.171333Patch availableCNA
TP-LinkKP200 v3before 1.1.0 Build 250225 Rel.1717241.1.0 Build 250225 Rel.171724Patch availableCNA
TP-LinkKP303 v2before 1.1.2 Build 241220 Rel.1733211.1.2 Build 241220 Rel.173321Patch availableCNA
TP-LinkKS200 v1before 1.1.2 Build 241223 Rel.1038571.1.2 Build 241223 Rel.103857Patch availableCNA
TP-LinkEP40A v1before 1.1.1 Build 250908 Rel.1125261.1.1 Build 250908 Rel.112526Patch availableCNA
TP-LinkKS220 v1before 1.1.3 Build 241223 Rel.1055151.1.3 Build 241223 Rel.105515Patch availableCNA
TP-LinkKS200M v1before 1.1.4 Build 241223 Rel.1047001.1.4 Build 241223 Rel.104700Patch availableCNA
TP-LinkES20M v1before 1.1.6 Build 250522 Rel.2102541.1.6 Build 250522 Rel.210254Patch availableCNA
TP-LinkKS220M v1before 1.1.6 Build 250522 Rel.2102541.1.6 Build 250522 Rel.210254Patch availableCNA
TP-LinkKP400 v3before 1.1.0 Build 250225 Rel.1717231.1.0 Build 250225 Rel.171723Patch availableCNA
TP-LinkKL125 v4before 1.1.1 Build 260710 Rel.0826461.1.1 Build 260710 Rel.082646Patch availableCNA
TP-LinkKL135 v2before 1.1.1 Build 260710 Rel.0826461.1.1 Build 260710 Rel.082646Patch availableCNA
TP-LinkKL110 v4before 1.1.1 Build 260710 Rel.0826461.1.1 Build 260710 Rel.082646Patch availableCNA
TP-LinkKL420L5 v1before 1.4.2 Build 260605 Rel.0350331.4.2 Build 260605 Rel.035033Patch availableCNA
  • HS103 v5 VendorTP-Link Affected before 1.1.3 Build 250908 Rel.112508 Fixed in 1.1.3 Build 250908 Rel.112508 Patch available CNA
  • EP10 v1 VendorTP-Link Affected before 1.1.1 Build 250908 Rel.112508 Fixed in 1.1.1 Build 250908 Rel.112508 Patch available CNA
  • EP40 v1 VendorTP-Link Affected before 1.1.0 Build 250225 Rel.171723 Fixed in 1.1.0 Build 250225 Rel.171723 Patch available CNA
  • HS200 v5 VendorTP-Link Affected before 1.1.2 Build 241220 Rel.165559 Fixed in 1.1.2 Build 241220 Rel.165559 Patch available CNA
  • KP401 v1 VendorTP-Link Affected before 1.1.2 Build 241223 Rel.094434 Fixed in 1.1.2 Build 241223 Rel.094434 Patch available CNA
  • KS230 KIT v2 VendorTP-Link Affected before 1.1.4 Build 241223 Rel.105830 Fixed in 1.1.4 Build 241223 Rel.105830 Patch available CNA
  • KP405 v1 VendorTP-Link Affected before 1.1.0 Build 250225 Rel.174632 Fixed in 1.1.0 Build 250225 Rel.174632 Patch available CNA
  • HS220 v3 VendorTP-Link Affected before 1.1.4 Build 241220 Rel.171050 Fixed in 1.1.4 Build 241220 Rel.171050 Patch available CNA
  • KP115 v1 VendorTP-Link Affected before 1.1.1 Build 250908 Rel.112945 Fixed in 1.1.1 Build 250908 Rel.112945 Patch available CNA
  • HS210 v3 VendorTP-Link Affected before 1.1.0 Build 250225 Rel.163425 Fixed in 1.1.0 Build 250225 Rel.163425 Patch available CNA
  • HS300 v2 VendorTP-Link Affected before 1.1.2 Build 241220 Rel.171333 Fixed in 1.1.2 Build 241220 Rel.171333 Patch available CNA
  • KP200 v3 VendorTP-Link Affected before 1.1.0 Build 250225 Rel.171724 Fixed in 1.1.0 Build 250225 Rel.171724 Patch available CNA
  • KP303 v2 VendorTP-Link Affected before 1.1.2 Build 241220 Rel.173321 Fixed in 1.1.2 Build 241220 Rel.173321 Patch available CNA
  • KS200 v1 VendorTP-Link Affected before 1.1.2 Build 241223 Rel.103857 Fixed in 1.1.2 Build 241223 Rel.103857 Patch available CNA
  • EP40A v1 VendorTP-Link Affected before 1.1.1 Build 250908 Rel.112526 Fixed in 1.1.1 Build 250908 Rel.112526 Patch available CNA
  • KS220 v1 VendorTP-Link Affected before 1.1.3 Build 241223 Rel.105515 Fixed in 1.1.3 Build 241223 Rel.105515 Patch available CNA
  • KS200M v1 VendorTP-Link Affected before 1.1.4 Build 241223 Rel.104700 Fixed in 1.1.4 Build 241223 Rel.104700 Patch available CNA
  • ES20M v1 VendorTP-Link Affected before 1.1.6 Build 250522 Rel.210254 Fixed in 1.1.6 Build 250522 Rel.210254 Patch available CNA
  • KS220M v1 VendorTP-Link Affected before 1.1.6 Build 250522 Rel.210254 Fixed in 1.1.6 Build 250522 Rel.210254 Patch available CNA
  • KP400 v3 VendorTP-Link Affected before 1.1.0 Build 250225 Rel.171723 Fixed in 1.1.0 Build 250225 Rel.171723 Patch available CNA
  • KL125 v4 VendorTP-Link Affected before 1.1.1 Build 260710 Rel.082646 Fixed in 1.1.1 Build 260710 Rel.082646 Patch available CNA
  • KL135 v2 VendorTP-Link Affected before 1.1.1 Build 260710 Rel.082646 Fixed in 1.1.1 Build 260710 Rel.082646 Patch available CNA
  • KL110 v4 VendorTP-Link Affected before 1.1.1 Build 260710 Rel.082646 Fixed in 1.1.1 Build 260710 Rel.082646 Patch available CNA
  • KL420L5 v1 VendorTP-Link Affected before 1.4.2 Build 260605 Rel.035033 Fixed in 1.4.2 Build 260605 Rel.035033 Patch available CNA

Remediation

Update each device to the fixed build for its model. The fixed builds include HS103 v5 1.1.3 Build 250908 Rel.112508, EP10 v1 1.1.1 Build 250908 Rel.112508, EP40 v1 1.1.0 Build 250225 Rel.171723, HS200 v5 1.1.2 Build 241220 Rel.165559, and KP401 v1 1.1.2 Build 241223 Rel.094434, and other models.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA HS103 v5 (TP-Link Systems Inc.) Fixed in 1.1.3 Build 250908 Rel.112508
  • Fix · CNA EP10 v1 (TP-Link Systems Inc.) Fixed in 1.1.1 Build 250908 Rel.112508
  • Fix · CNA EP40 v1 (TP-Link Systems Inc.) Fixed in 1.1.0 Build 250225 Rel.171723
  • Fix · CNA HS200 v5 (TP-Link Systems Inc.) Fixed in 1.1.2 Build 241220 Rel.165559
  • Fix · CNA KP401 v1 (TP-Link Systems Inc.) Fixed in 1.1.2 Build 241223 Rel.094434
  • Fix · CNA KS230 KIT v2 (TP-Link Systems Inc.) Fixed in 1.1.4 Build 241223 Rel.105830
  • Fix · CNA KP405 v1 (TP-Link Systems Inc.) Fixed in 1.1.0 Build 250225 Rel.174632
  • Fix · CNA HS220 v3 (TP-Link Systems Inc.) Fixed in 1.1.4 Build 241220 Rel.171050
  • Fix · CNA KP115 v1 (TP-Link Systems Inc.) Fixed in 1.1.1 Build 250908 Rel.112945
  • Fix · CNA HS210 v3 (TP-Link Systems Inc.) Fixed in 1.1.0 Build 250225 Rel.163425
  • Fix · CNA HS300 v2 (TP-Link Systems Inc.) Fixed in 1.1.2 Build 241220 Rel.171333
  • Fix · CNA KP200 v3 (TP-Link Systems Inc.) Fixed in 1.1.0 Build 250225 Rel.171724
  • Fix · CNA KP303 v2 (TP-Link Systems Inc.) Fixed in 1.1.2 Build 241220 Rel.173321
  • Fix · CNA KS200 v1 (TP-Link Systems Inc.) Fixed in 1.1.2 Build 241223 Rel.103857
  • Fix · CNA EP40A v1 (TP-Link Systems Inc.) Fixed in 1.1.1 Build 250908 Rel.112526
  • Fix · CNA KS220 v1 (TP-Link Systems Inc.) Fixed in 1.1.3 Build 241223 Rel.105515
  • Fix · CNA KS200M v1 (TP-Link Systems Inc.) Fixed in 1.1.4 Build 241223 Rel.104700
  • Fix · CNA ES20M v1 (TP-Link Systems Inc.) Fixed in 1.1.6 Build 250522 Rel.210254
  • Fix · CNA KS220M v1 (TP-Link Systems Inc.) Fixed in 1.1.6 Build 250522 Rel.210254
  • Fix · CNA KP400 v3 (TP-Link Systems Inc.) Fixed in 1.1.0 Build 250225 Rel.171723
  • Fix · CNA KL125 v4 (TP-Link Systems Inc.) Fixed in 1.1.1 Build 260710 Rel.082646
  • Fix · CNA KL135 v2 (TP-Link Systems Inc.) Fixed in 1.1.1 Build 260710 Rel.082646
  • Fix · CNA KL110 v4 (TP-Link Systems Inc.) Fixed in 1.1.1 Build 260710 Rel.082646
  • Fix · CNA KL420L5 v1 (TP-Link Systems Inc.) Fixed in 1.4.2 Build 260605 Rel.035033

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-108473
  2. 2026-10-14 Alias added: GHSA-jmmx-r2fg-mcgh
  3. 2026-10-14 Priority changed: MEDIUM → LOW
  4. 2026-10-15 CISA SSVC decision points changed

References

Patch 2

Advisory 1

  • TI-2023-16571 TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain… KEVCVSS 3.1HIGH 8.8
  • TI-2023-01313 Command injection in TP-Link Archer AX21 KEVCVSS 3.1HIGH 8.8
  • TI-2020-14907 TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the… KEVCVSS 3.1HIGH 8.8
  • TI-2025-08589 Authenticated RCE via Parental Control command injection KEVCVSS 4.0HIGH 8.6
  • TI-2015-02672 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317… KEVCVSS 3.1HIGH 7.5
  • TI-2023-27456 Authentication bypass by spoofing in TP-Link TL-WR841N KEVCVSS 3.1MEDIUM 6.5
See all 636 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences