TP-Link published a security advisory on 14 October 2026 for CVE-2026-108473, a missing-authentication flaw (CWE-306) in the local device-management protocol of 24 Kasa smart plugs, power strips, wall switches, bulbs and light strips. An attacker on the same local network can send management commands without logging in and change a device's state or settings. TP-Link rates it 8.7 (High) under CVSS v4.0, with no privileges and no user interaction required.

There is a second, conditional part. TP-Link says that "under certain usage conditions" involving the mobile app, the device and the cloud service, account-related traffic is not protected well enough and account information may leak, which could lead to a compromised TP-Link cloud account. The advisory does not describe those conditions in more detail.

Affected models and fixed firmware

The list covers plugs and switches HS103 V5, EP10 V1, EP40 V1, EP40A V1, HS200 V5, HS210 V3, HS220 V3, HS300 V2, KP115 V1, KP200 V3, KP303 V2, KP400 V3, KP401 V1, KP405 V1, KS200 V1, KS200M, KS220, KS220M, ES20M and the KS230 KIT V2, plus the KL110 V4, KL125 V4 and KL135 V2 bulbs and the KL420L5 V1 light strip. A few examples of fixed versions:

  • HS103 V5: 1.1.3 Build 250908 Rel.112508
  • KP115 V1: 1.1.1 Build 250908 Rel.112945
  • HS300 V2: 1.1.2 Build 241220 Rel.171333
  • KL125, KL135 and KL110: 1.1.1 Build 260710 Rel.082646
  • KL420L5 V1: 1.4.2 Build 260605 Rel.035033

Check the full table in the advisory for your exact hardware version. Many of the fixed builds carry numbers such as 241220 or 250225, which suggests the patched firmware has been out for months. If your devices take automatic updates, they may already be safe, but confirm the version in the Kasa app instead of assuming.

How worried to be

The attack vector is "adjacent", so nobody can exploit this straight from the internet. Someone first needs a foothold on your LAN: a guest who knows the Wi-Fi password, a compromised laptop or another hacked IoT device. The OpenCVE record puts the EPSS score below 1% and the flaw is not in the CISA Known Exploited Vulnerabilities catalogue.

That still makes it worth an evening. Update every affected Kasa device to the listed firmware, and if you already keep smart home gear on a separate VLAN or IoT network, this is the kind of bug that isolation is for. On the cloud side, a strong, unique password and two-factor authentication on the TP-Link account reduce the damage if account data does leak.