CVE-2026-76784
HIGH
8,7
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Attack Vector: adjacent
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
Multiple
TP-Link Kasa smart home devices contain insufficient cryptographic protections
in the local device communication protocol. An adjacent network attacker may
intercept, replay or forge locally exchanged control messages, potentially
resulting in unauthorized device control.
Successful
exploitation could allow an attacker to manipulate the operational state of an
affected device, resulting in unauthorized state changes, disruption of normal
device functionality or a denial-of-service condition.
325
Missing Cryptographic Step
DraftCommon Consequences
Security Scopes Affected:
Access Control
Confidentiality
Integrity
Accountability
Non-Repudiation
Potential Impacts:
Bypass Protection Mechanism
Read Application Data
Modify Application Data
Hide Activities
Applicable Platforms
All platforms may be affected
https://www.tp-link.com/en/support/download/
https://www.tp-link.com/in/support/download/
https://www.tp-link.com/us/support/download/
https://www.tp-link.com/us/support/faq/5267/