CVE-2026-108473 Details

A vulnerability allowing improper authentication has been identified in multiple Kasa devices from TP-Link. This issue arises within the local device-management protocol, where an unauthenticated adjacent attacker can send management commands to affected devices without proper authentication or authorization. Exploitation of this vulnerability could lead to unauthorized modifications of the device state or management settings. Additionally, under certain conditions involving the user, mobile application, and device-cloud service, there may be insufficient protection of account-related communications, potentially exposing account information. Successful exploitation could disrupt legitimate user control and, in some cases, compromise the associated cloud account.

Users are advised to update their devices to the latest firmware version. Instructions for downloading the update are available on the TP-Link Download Center.