TP-Link Kasa EUVD-2026-66641

Exploitation requires network adjacency: the attacker must be on the same Layer 2 segment or broadcast domain as the target Kasa device - for example, connected to the same Wi-Fi access point, VLAN, or Ethernet switch. No authentication is required (PR:N) and no user interaction is needed (UI:N), meaning any device reachable from the local network can be attacked autonomously. No non-default configuration or special feature flag is required; the vulnerability is present in the default local control protocol active on all affected models. The primary limiting factor is the adjacency requirement - internet-based attackers are blocked unless they have first compromised a local host or gained Wi-Fi credentials.

The CVSS 4.0 score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) is well-calibrated: severity is genuinely high once adjacency is achieved, but the attack surface is substantially bounded by the requirement to be on the same network segment as the target device. This is not an internet-exposed vulnerability - remote exploitation requires a prior foothold on the local network. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. EPSS data was not available in the provided intelligence. The AC:L and PR:N metrics confirm that once adjacency is established, exploitation is trivially automatable with no privilege requirements. The highest realistic risk scenario is an attacker who has already compromised a host or gained Wi-Fi access and uses these devices as pivot targets or to cause physical disruption - organizations managing IoT-heavy branch offices or shared network environments where device segmentation is absent should treat this as a meaningful lateral risk.

An attacker connected to the same Wi-Fi network - via a compromised guest SSID, rogue insider access, or post-compromise lateral movement - passively captures Kasa local protocol traffic to identify the unprotected message format. Because messages lack cryptographic integrity verification or replay protection, the attacker then replays a previously captured 'power off' command or forges a crafted control message targeting a smart plug controlling critical equipment, toggling it off repeatedly to cause a denial-of-service condition. No public proof-of-concept code has been identified, but the Kasa local protocol structure has been extensively documented by the security research community, substantially reducing the skill barrier for exploitation.