Es20M V1
Monthly
Improper authentication in the local device-management protocol of TP-Link Kasa smart plugs, switches, dimmers, and bulbs lets an unauthenticated attacker who is already on the same Wi-Fi/LAN segment send management instructions to the device, changing device state and settings or disrupting legitimate user control. The vendor scores this 8.7 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity, and availability impact to the device), and the independent assessment agrees: authentication is not required within the adjacent network (PR:N, CWE-306), but the ADJACENT attack vector confines exploitation to attackers holding a foothold on the local segment rather than the public internet. No public exploit code has been identified at time of analysis, and the described cloud-account information exposure is conditional - it depends on concurrent user, mobile-app, and device-cloud interaction - so full account compromise is not guaranteed.
Improper authentication in the local device-management protocol of TP-Link Kasa smart plugs, switches, dimmers, and bulbs lets an unauthenticated attacker who is already on the same Wi-Fi/LAN segment send management instructions to the device, changing device state and settings or disrupting legitimate user control. The vendor scores this 8.7 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity, and availability impact to the device), and the independent assessment agrees: authentication is not required within the adjacent network (PR:N, CWE-306), but the ADJACENT attack vector confines exploitation to attackers holding a foothold on the local segment rather than the public internet. No public exploit code has been identified at time of analysis, and the described cloud-account information exposure is conditional - it depends on concurrent user, mobile-app, and device-cloud interaction - so full account compromise is not guaranteed.