TP-Link Kasa EUVD-2026-100759

Requires the attacker to be on the adjacent network (same Wi-Fi/LAN segment as the Kasa device, per AV:A) - not exploitable from the public internet. Within that network, no authentication is needed (PR:N/CWE-306): the local device-management protocol accepts management instructions without adequate authentication or authorization, so basic device-state/settings manipulation needs no special configuration against affected Kasa models. The additional account-information exposure is NOT unconditional - it requires 'certain usage conditions involving interaction between the user, mobile application, and device-cloud service,' meaning the cloud-account-compromise outcome depends on concurrent legitimate user/app/cloud activity. Primary limiting factor: adjacency requirement; secondary limiting factor: the cloud-account impact is conditional rather than guaranteed.

The vendor-provided CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 8.7) describes a low-complexity, unauthenticated attack against confidentiality, integrity, and availability of the affected device - but critically, the attack vector is ADJACENT (AV:A), not network/internet-facing, which materially constrains real-world exploitability to attackers who already have a foothold on the same local/Wi-Fi segment as the device. This is consistent with the description's framing of a 'local device-management protocol' and an 'adjacent-network attacker.' No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or widespread exploitation; this appears to be a vendor-discovered-and-disclosed issue (reported by TP-Link) with a patch already available, rather than an actively weaponized threat. The core device-management weakness (CWE-306, missing authentication) is unconditional for an adjacent attacker, but the more serious cloud-account-compromise outcome is explicitly conditional ('under certain usage conditions involving interaction between the user, mobile application, and device-cloud service'), so the worst-case impact should not be treated as always-reachable. Net: a genuinely high-severity design flaw in its threat model (local attacker can hijack device control), but real-world priority is tempered by the adjacent-only vector and absence of any exploitation evidence - prioritize patching for high-value or shared-network deployments over treating it as an internet-exposed emergency.

An attacker who has joined the same local/Wi-Fi network as a Kasa smart plug, switch, or bulb sends crafted management instructions directly to the device's local management protocol without any authentication, toggling or reconfiguring the device and disrupting the legitimate owner's control. In a chained case where the targeted user is actively interacting with the device via the mobile app and cloud service, insufficient protection of account-related communications could additionally leak account information, potentially leading to cloud-account compromise. No public exploit code was identified in the provided data.