Executive brief
TP-Link Kasa smart home devices use weak encryption in their local network communication protocol. An attacker on the same network segment can intercept, replay, or forge control messages to remotely manipulate device settings—such as turning lights on/off or changing thermostat temperatures—without authorization, disrupting normal operation or denying service to legitimate users.
Technical details
The vulnerability is a cryptographic weakness in the local device communication protocol used by TP-Link Kasa smart home devices. An adjacent network attacker (requiring presence on the same network segment) can intercept, replay, or forge locally exchanged control messages due to insufficient cryptographic protections. This allows an attacker to manipulate the operational state of affected devices, resulting in unauthorized state changes, disruption of normal device functionality, or denial-of-service conditions. No patch information is currently available in the advisory.
Affected products
- TP-Link Kasa Smart Home Devices
Timeline
- 2026-08-26: disclosed