TP-Link HS100 Smart Plug

TP-Link HS100 Smart Plug
Security Grade F Calculator v	TP-Link HS100 Smart Plug Brand: TP-Link (Parent: TP-Link Corporation) Category: Smart plug • Model / Gen: 1st HS100 Release Date: 2015-03-01 • Status: End of life Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	1. Hardware teardown possible, but tampering incidents are not widespread 2.
Known vulnerabilities	Very common	🔗 Proof	Multiple CVEs including unauthenticated remote command execution
Prior attacks	Rare	🔗 Proof	Proof-of-concept exploits exist, large-scale attacks are uncommon
Updatability	Rare	🔗 Proof	End of life, no new security firmware patches
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Works with TP-Link Kasa ecosystem, limited third-party integration
Communications	Encrypted with obselete encryption	🔗 Proof	Early firmware uses weak crypto and plaintext traffic in some cases
Storage	No encryption	🔗 Proof	Local storage does not encrypt configuration data
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Full account management inside Kasa app
Authentication	Basic	🔗 Proof	1. Basic password authentication, 2FA not supported on this old model 2.
Brute-force protection	Absent	🔗 Proof	No built-in brute force rate limiting
Event logging	Partial logging	🔗 Proof	1. Only basic power state events logged, no detailed access logs 2.
Passwords	Default/Common/Easy to guess	🔗 Proof	Early versions had default credentials and weak password rules
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	TP-Link proprietary RTOS (Companion App: Kasa Smart)
Hardware (CPU / GPU)	CPU: Not publicly disclosed • GPU: Not publicly disclosed
Memory & Storage	Memory: Not publicly disclosed • Storage: Not publicly disclosed
Power, Battery & Charging	Battery: None • Power: AC 100–240 V mains power • Charging: Not applicable
Display & Camera	Display: None • Camera: None
Sound & Connectivity	Sound: None • Connectivity: Wi‑Fi 802.11 b/g/n, 2.4 GHz
Physical (Dimensions & Mass)	Dimensions: 100 × 66 × 77 mm • Mass: 180 g

This is an end-of-life Wi-Fi smart plug. It has multiple serious vulnerabilities including unauthenticated RCE. It lacks strong authentication, brute force protection and encrypted local storage. Old communication encryption is insecure.