The vulnerability resides in the local device‑management protocol of multiple TP‑Link Kasa devices, representing a CWE‑306 (improper authentication) flaw. An attacker who shares the same local network can send management commands without authenticating, allowing the modification of device state or configuration settings. In certain interaction scenarios with the mobile app and cloud service, the same lack of protection may expose account‑related data, potentially leading to compromise of the cloud account.

Affected products are TP‑Link Kasa devices including EP10 v1, EP40 v1, EP40A v1, ES20M v1, HS103 v5, HS200 v5, HS210 v3, HS220 v3, HS300 v2, KL110 v4, KL125 v4, KL135 v2, KL420L5 v1, KP115 v1, KP200 v3, KP303 v2, KP400 v3, KP401 v1, KP405 v1, KS200 v1, KS200M v1, KS220 v1, KS220M v1, KS230 KIT v2.

The CVSS score of 8.7 classifies this as a High severity vulnerability. The EPSS score of less than 1 percent indicates a very low likelihood of exploitation, and it is not included in the CISA KEV catalog. Because of the CWE‑306 (improper authentication) flaw, an attacker who shares the same local network and does not need physical access can send management commands without proper authentication. Successful exploitation permits unauthorized device management actions, which could change device behavior or disable user controls, and in some cases may expose cloud account information.