EUVD-2026-66641
GHSA-pfwg-rgvf-86xw
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only vector (AV:A) confirmed by local protocol scope; no privileges or user interaction required; full CIA impact on the vulnerable device with no scope change to subsequent systems.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control.
Successful exploitation could allow an attacker to manipulate the operational state of an affected device, resulting in unauthorized state changes, disruption of normal device functionality or a denial-of-service condition.
AnalysisAI
Unauthorized device control of TP-Link Kasa smart home devices is achievable by any attacker with local network adjacency, due to missing required cryptographic protections (CWE-325) in the local LAN communication protocol. At least 20 distinct Kasa product models are affected, spanning smart plugs, power strips, outdoor outlets, and in-wall switches. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network adjacency: the attacker must be on the same Layer 2 segment or broadcast domain as the target Kasa device - for example, connected to the same Wi-Fi access point, VLAN, or Ethernet switch. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) is well-calibrated: severity is genuinely high once adjacency is achieved, but the attack surface is substantially bounded by the requirement to be on the same network segment as the target device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker connected to the same Wi-Fi network - via a compromised guest SSID, rogue insider access, or post-compromise lateral movement - passively captures Kasa local protocol traffic to identify the unprotected message format. Because messages lack cryptographic integrity verification or replay protection, the attacker then replays a previously captured 'power off' command or forges a crafted control message targeting a smart plug controlling critical equipment, toggling it off repeatedly to cause a denial-of-service condition. … |
| Remediation | Apply the firmware update available through TP-Link's official download portals: https://www.tp-link.com/us/support/download/ (US), https://www.tp-link.com/en/support/download/ (global), and https://www.tp-link.com/in/support/download/ (India). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all TP-Link Kasa devices deployed in the organization and document their firmware versions and network placement. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-325 – Missing Cryptographic Step
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today