---
id: CVE-2026-108473
title: |-
  Multiple
  Kasa devices contain an improper authentication vulnerability in the local
  device-management protocol
summary: |-
  Multiple
  Kasa devices contain an improper authentication vulnerability in the local
  device-management protocol. An unauthenticated adjacent attacker may send
  management instructions to an affected device without adequate authentication
  o…
severity: none
cwe:
  - CWE-306
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T01:17:06.030'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108473'
references:
  - url: 'https://www.tp-link.com/en/support/download/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/us/support/download/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/us/support/faq/5342/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
tags:
  - nvd
ingestedAt: '2026-10-14T02:10:14.764Z'
---

## Overview

Multiple
Kasa devices contain an improper authentication vulnerability in the local
device-management protocol. An unauthenticated adjacent attacker may send
management instructions to an affected device without adequate authentication
or authorization, allowing modification of the device state or management
settings. Under certain usage conditions involving interaction between the
user, mobile application, and device-cloud service, insufficient protection of
account-related communications may also expose account information.









Successful
exploitation may allow an unauthenticated adjacent-network attacker to perform
unauthorized device-management actions and disrupt legitimate user control.
Under certain conditions, account-related information may also be exposed,
potentially leading to compromise of the associated cloud account.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.