TP-Link Patches a Kasa Flaw That Lets Anyone on Your Wi-Fi Control the Device

The short version: if you have a Kasa device on TP-Link’s list, update it. If you only use the Kasa app, updating is the only step. The flaw needs someone already on your home network, not someone out on the internet, and TP-Link’s only listed fix is the update. The people with something to think about are the ones controlling Kasa devices locally from Hubitat or Home Assistant, because Kasa updates have broken that for some users before.

TP-Link published a security advisory for a long list of Kasa plugs, switches and bulbs, last updated October 14 (TP-Link). The flaw is CVE-2026-108473. A CVE is the ID number given to a publicly known security flaw. It’s rated 8.7 out of 10, which TP-Link calls High.

The problem is in the protocol Kasa devices use for local management, meaning commands sent over your home network rather than through TP-Link’s servers. TP-Link says someone on the same network can send management commands to an affected device without logging in, changing its state or settings and disrupting legitimate user control. TP-Link also says that under certain conditions involving the user, the app and TP-Link’s cloud (its online service the Kasa app uses), account information may be exposed, potentially leading to compromise of the cloud account. The advisory doesn’t say more than that about it.

“On the same network” is the important part. Someone on the internet can’t do this directly. It takes a device on your Wi-Fi: a guest’s phone, a compromised gadget, or someone who knows your Wi-Fi password.

I have two Kasa plugs year-round and use more for Christmas automations. They run on their own on the home Wi-Fi and are hooked to Alexa, not through Hubitat or Home Assistant. Mine are on current firmware.

Affected models

The fix is a firmware update. Firmware is the software that runs on the device itself. TP-Link lists models by hardware version, which is printed on the device label. Then compare the fixed build below to the firmware version the Kasa app shows for that device. If your model and hardware version aren’t listed, this advisory doesn’t cover it.

TP-Link’s list, last checked October 25:

Check TP-Link’s page for the exact build string before you rely on this table. Most of these builds date from December 2024 to July 2026, so a device that has been taking updates may already be on one.

A separate Kasa advisory from August, CVE-2026-76784, covers weak encryption in the same local protocol and also scores 8.7, though TP-Link rates its effect on device availability lower (TP-Link). For the HS103, EP10, HS300 V2, KP303 V2, EP40A, KP115, ES20M and KS220M, KP200 V3 and KL125, both advisories list the same fixed build, so one update covers both.

The catch for local control (only if you use Hubitat or Home Assistant)

Local control means Hubitat or Home Assistant talks to the device directly over your network instead of going through TP-Link’s cloud. Both do this through an integration, the add-on that connects them to a brand of device.

Kasa updates have broken that for some users before. Hubitat’s docs for its built-in Kasa integration say some users have reported losing local control after Kasa firmware updates, and suggest turning off automatic firmware updates if you rely on local control (Hubitat). Home Assistant’s TP-Link docs suggest the same for older devices that don’t yet require a login (Home Assistant).

No source so far ties these fixed builds to broken local control, but the usual local-first advice for Kasa is to avoid updates, and this advisory says to update.

What’s known about getting local control back after an update:

• Third-Party Compatibility is a switch in the Kasa app that lets outside software like Hubitat and Home Assistant connect. Home Assistant says some firmware versions require Third-Party Compatibility to be turned on before they allow local access. Hubitat’s docs point to the same switch.
• In August an EP25 owner reported a forced update broke Home Assistant’s local login. Turning on Third-Party Apps in the Kasa app settings fixed it (python-kasa issue). The EP25 isn’t on this advisory, though EP25 V2 is on the August one.
• Home Assistant needs your TP-Link account email and password for newer devices, even though it talks to them locally.
• Hubitat’s Kasa integration doesn’t support the Matter versions of Kasa devices, like the KP125M. Those get added through Hubitat’s Matter support instead.

What to do

1. Check each Kasa device’s model and hardware version against TP-Link’s list.
2. If it’s listed and on older firmware, update it in the Kasa app.
3. Only if you use Hubitat or Home Assistant: afterward, check that it can still control the device. If not, turn on Third-Party Compatibility in the Kasa app (Me > Settings > Third-Party Compatibility) and try again.
4. If you’d rather not update, the risk comes from things on your own network. Putting smart plugs or guests on a separate network, like a guest Wi-Fi, is common general practice for limiting who can reach them. If you move devices to a different subnet from Home Assistant, its docs say automatic discovery won’t work and you’ll need to add them by IP address.

I don’t keep mine on a separate network. I’m considering it.

Home Assistant’s docs also mention factory resetting the device and blocking it from the internet. That stops updates, so it also keeps the flaw.