Loading vulnerability…
Insufficient Cryptographic Protection in TP-Link Kasa Local Device Communications
CVE-2026-76784 affects the local device communication protocol of multiple TP-Link Kasa smart-home products, including smart plugs, switches, and bulbs. Insufficient cryptographic protection of message integrity and authenticity allows an adjacent-network attacker to intercept, replay, or forge locally exchanged control messages. Exploitation requires no authentication, privileges, or user interaction and can result in unauthorized device control, operational-state changes, disruption, or denial of service. The vulnerability is rated High with a CVSS v4.0 score of 8.7.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality of local control communications and the integrity and availability of affected devices. Attackers may turn plugs, switches, or lights on or off, alter schedules or configurations, interrupt connected appliances, and cause denial-of-service conditions through unauthorized control messages.
If you can’t patch tonight, do this now.
Until firmware updates are applied, isolate affected Kasa devices on a dedicated IoT network or VLAN and restrict access from guest networks and less-trusted systems. Limit local communication to authorized controllers and monitor for unexpected state changes, repeated commands, or device unavailability.
Patch, then assume compromise.
Install TP-Link's model-specific fixed firmware through the Kasa Smart application or official TP-Link Download Center. Verify the exact model, hardware revision, and regional variant before selecting firmware. Identified fixed releases include 1.1.3 Build 250908 Rel.112508 for HS103P3 and HS103P4 devices, and 1.1.1 Build 260710 Rel.082646 for KL125 devices. These versions are not universal fixes for all affected Kasa products; use the applicable fixed release for each device.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.