| TP-Link HS100 Smart Plug (HS100) | ||
|---|---|---|
|
Security Grade
Calculator v
|
TP-Link HS100 Wi-Fi Smart Plug
Brand: TP-Link (Parent: TP-Link Technologies Co., Ltd.) Category: Smart plug • Model / Gen: 1st HS100 Release Date: 2015-03-01 • Status: End of life Classification Date: • Official Website | |
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | Physical disassembly is possible, large-scale physical tampering incidents are rare |
| Known vulnerabilities | Very common | 🔗 Proof | Multiple vulnerabilities including unauthenticated local API and information disclosure |
| Prior attacks | Rare | 🔗 Proof | Local network PoC exploits exist, widespread internet attacks are uncommon |
| Updatability | Rare | 🔗 Proof | End of life, TP-Link no longer releases new security firmware patches |
| Category Score | Score: 3 / 3 | ||
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | 🔗 Proof | Works within Kasa ecosystem, limited third-party integration support |
| Communications | Encrypted with obselete encryption | 🔗 Proof | Local control traffic uses outdated encryption implementation |
| Storage | No encryption | 🔗 Proof | Local configuration and credential data are stored without encryption |
| Category Score | Score: 3 / 3 | ||
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | 🔗 Proof | Basic device pairing and admin control, no fine-grained multi-user management |
| Authentication | Basic | 🔗 Proof | Weak local authentication mechanism, no 2FA support on the device |
| Brute-force protection | Absent | 🔗 Proof | No built-in rate limiting for local API or login attempts |
| Event logging | Partial logging | 🔗 Proof | Only simple power on/off state history, no detailed access audit logs |
| Passwords | Default/Common/Easy to guess | 🔗 Proof | Early firmware has weak default authentication and predictable local keys |
| Category Score | Score: 3 / 3 | ||
| Property | Details |
|---|---|
| Operating System & App | TP-Link proprietary RTOS (Companion App: Kasa) |
| Hardware (CPU / GPU) | CPU: Not publicly disclosed • GPU: Not publicly disclosed |
| Memory & Storage | Memory: Not publicly disclosed • Storage: Not publicly disclosed |
| Power, Battery & Charging | Battery: None • Power: AC 100–240 V mains power • Charging: Not applicable |
| Display & Camera | Display: None • Camera: None |
| Sound & Connectivity | Sound: None • Connectivity: Wi‑Fi 802.11 b/g/n, 2.4 GHz |
| Physical (Dimensions & Mass) | Dimensions: 100 × 66 × 77 mm • Mass: 186 g |
This is an EOL TP-Link Kasa smart plug. It has known unauthenticated local API vulnerabilities and obsolete encryption. It lacks brute force protection and encrypted local credential storage.
