{"api_version":"1","generated_at":"2026-08-26T19:30:27+00:00","cve":"CVE-2026-76784","urls":{"html":"https://cve.report/CVE-2026-76784","api":"https://cve.report/api/cve/CVE-2026-76784.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-76784","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-76784"},"summary":{"title":"Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices","description":"Multiple\nTP-Link Kasa smart home devices contain insufficient cryptographic protections\nin the local device communication protocol. An adjacent network attacker may\nintercept, replay or forge locally exchanged control messages, potentially\nresulting in unauthorized device control. \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation could allow an attacker to manipulate the operational state of an\naffected device, resulting in unauthorized state changes, disruption of normal\ndevice functionality or a denial-of-service condition.","state":"PUBLISHED","assigner":"TPLink","published_at":"2026-08-26 18:17:01","updated_at":"2026-08-26 18:17:01"},"problem_types":["CWE-325","CWE-325 CWE-325: Missing Cryptographic Step"],"metrics":[{"version":"4.0","source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","score":"8.7","severity":"HIGH","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"8.7","severity":"HIGH","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","data":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}}],"references":[{"url":"https://www.tp-link.com/us/support/download/","name":"https://www.tp-link.com/us/support/download/","refsource":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.tp-link.com/us/support/faq/5267/","name":"https://www.tp-link.com/us/support/faq/5267/","refsource":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.tp-link.com/in/support/download/","name":"https://www.tp-link.com/in/support/download/","refsource":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.tp-link.com/en/support/download/","name":"https://www.tp-link.com/en/support/download/","refsource":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76784","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76784","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"HS103P3 / HS103P4 v5","version":"affected 1.1.3 Build 250908 Rel.112508 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"EP10","version":"affected 1.1.1 Build 250908 Rel.112508 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"EP25 V2","version":"affected 1.0.3 Build 240529 Rel.145252 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"HS300 V2","version":"affected 1.1.2 Build 241220 Rel.171333 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"KP303 V2","version":"affected 1.1.2 Build 241220 Rel.173321 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"EP40A","version":"affected 1.1.1 Build 250908 Rel.112526 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"KP125MP2 / KP125MP4","version":"affected 1.2.5 Build 241213 Rel.172504 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"KP115","version":"affected 1.1.1 Build 250908 Rel.112945 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"KS225","version":"affected 1.1.1 Build 240626 Rel.175125 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"EP40M","version":"affected 1.1.0 Build 240415 Rel.171219 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"KS205","version":"affected 1.1.1 Build 240724 Rel.105920 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"KS240","version":"affected 1.0.6 Build 240122 Rel.160100 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"ES20M","version":"affected 1.1.6 Build 250522 Rel.210254 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"KS220M","version":"affected 1.1.6 Build 250522 Rel.210254 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"KP200 V3","version":"affected 1.1.0 Build 250225 Rel.171724 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"HS200 V5.26","version":"affected 1.0.3 Build 240723 Rel.192622 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"HS220-LA(US) 6.6 / HS220-BL(US) 6.6","version":"affected 1.0.3 Build 240723 Rel.192630 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"HS220 V3.26","version":"affected 1.1.1 Build 240802 Rel.094131 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"HS220-LA(US) 4.6 / HS220-BL(US) 4.6","version":"affected 1.1.1 Build 240802 Rel.094142 custom","platforms":[]},{"source":"CNA","vendor":"TP-Link Systems Inc.","product":"KL125","version":"affected 1.1.1 Build 260710 Rel.082646 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Priyanka Rushikesh Chaudhary (Research Scholar, CSIS Department, BITS Pilani, Hyderabad Campus, India), Rajib Ranjan Maiti (Associate Professor, CSIS Department, BITS Pilani, Hyderabad Campus, India)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"HS103P3 / HS103P4 v5","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.3 Build 250908 Rel.112508","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EP10","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.1 Build 250908 Rel.112508","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EP25 V2","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.0.3 Build 240529 Rel.145252","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"HS300 V2","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.2 Build 241220 Rel.171333","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"KP303 V2","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.2 Build 241220 Rel.173321","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EP40A","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.1 Build 250908 Rel.112526","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"KP125MP2 / KP125MP4","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.2.5 Build 241213 Rel.172504","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"KP115","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.1 Build 250908 Rel.112945","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"KS225","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.1 Build 240626 Rel.175125","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EP40M","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.0 Build 240415 Rel.171219","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"KS205","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.1 Build 240724 Rel.105920","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"KS240","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.0.6 Build 240122 Rel.160100","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"ES20M","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.6 Build 250522 Rel.210254","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"KS220M","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.6 Build 250522 Rel.210254","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"KP200 V3","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.0 Build 250225 Rel.171724","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"HS200 V5.26","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.0.3 Build 240723 Rel.192622","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"HS220-LA(US) 6.6 / HS220-BL(US) 6.6","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.0.3 Build 240723 Rel.192630","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"HS220 V3.26","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.1 Build 240802 Rel.094131","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"HS220-LA(US) 4.6 / HS220-BL(US) 4.6","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.1 Build 240802 Rel.094142","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"KL125","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.1 Build 260710 Rel.082646","status":"affected","version":"0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","value":"Priyanka Rushikesh Chaudhary (Research Scholar, CSIS Department, BITS Pilani, Hyderabad Campus, India), Rajib Ranjan Maiti (Associate Professor, CSIS Department, BITS Pilani, Hyderabad Campus, India)"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Multiple\nTP-Link Kasa smart home devices contain insufficient cryptographic protections\nin the local device communication protocol. An adjacent network attacker may\nintercept, replay or forge locally exchanged control messages, potentially\nresulting in unauthorized device control. </p><p>\n\n</p><p>Successful\nexploitation could allow an attacker to manipulate the operational state of an\naffected device, resulting in unauthorized state changes, disruption of normal\ndevice functionality or a denial-of-service condition.</p>"}],"value":"Multiple\nTP-Link Kasa smart home devices contain insufficient cryptographic protections\nin the local device communication protocol. An adjacent network attacker may\nintercept, replay or forge locally exchanged control messages, potentially\nresulting in unauthorized device control. \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation could allow an attacker to manipulate the operational state of an\naffected device, resulting in unauthorized state changes, disruption of normal\ndevice functionality or a denial-of-service condition."}],"impacts":[{"capecId":"CAPEC-594","descriptions":[{"lang":"en","value":"CAPEC-594 Traffic Injection"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-325","description":"CWE-325: Missing Cryptographic Step","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-26T17:47:54.278Z","orgId":"f23511db-6c3e-4e32-a477-6aa17d310630","shortName":"TPLink"},"references":[{"tags":["patch"],"url":"https://www.tp-link.com/us/support/download/"},{"tags":["patch"],"url":"https://www.tp-link.com/en/support/download/"},{"tags":["patch"],"url":"https://www.tp-link.com/in/support/download/"},{"tags":["vendor-advisory"],"url":"https://www.tp-link.com/us/support/faq/5267/"}],"source":{"discovery":"UNKNOWN"},"title":"Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices","x_generator":{"engine":"Vulnogram 1.0.4"}}},"cveMetadata":{"assignerOrgId":"f23511db-6c3e-4e32-a477-6aa17d310630","assignerShortName":"TPLink","cveId":"CVE-2026-76784","datePublished":"2026-08-26T17:47:54.278Z","dateReserved":"2026-08-19T17:32:21.874Z","dateUpdated":"2026-08-26T17:47:54.278Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-26 18:17:01","lastModifiedDate":"2026-08-26 18:17:01","problem_types":["CWE-325","CWE-325 CWE-325: Missing Cryptographic Step"],"metrics":{"cvssMetricV40":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"76784","Ordinal":"1","Title":"Insufficient Cryptographic Protections in Local Device Communica","CVE":"CVE-2026-76784","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"76784","Ordinal":"1","NoteData":"Multiple\nTP-Link Kasa smart home devices contain insufficient cryptographic protections\nin the local device communication protocol. An adjacent network attacker may\nintercept, replay or forge locally exchanged control messages, potentially\nresulting in unauthorized device control. \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation could allow an attacker to manipulate the operational state of an\naffected device, resulting in unauthorized state changes, disruption of normal\ndevice functionality or a denial-of-service condition.","Type":"Description","Title":"Insufficient Cryptographic Protections in Local Device Communica"}]}}}