| TP-Link Kasa Smart Plug Mini (HS103)
|
|
Security Grade
Calculator v1
|
Kasa Smart Wi-Fi Plug Mini
Release Date: 2022-05-23 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
—
|
No hardware tampering reports found in my search.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
TP-Link advisory CVE-2026-108473 (Oct 2026, CVSS v4.0 8.7): improper authentication in the local management protocol of Kasa devices incl. HS103.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
Researcher proof-of-concept clients exist for the Kasa local protocol; no in-the-wild attacks found.
|
| Updatability
|
Very common
|
🔗 Proof
|
TP-Link publishes firmware fixes via its Download Center and app (advisory updated Oct 14, 2026).
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Cloud features use a TP-Link account, but local management lacked adequate authentication (CVE-2026-108473).
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
Older Kasa plugs used a trivial XOR autokey scheme on TCP 9999; the 2026 advisory also reports insufficient protection of account-related communications.
|
| Storage
|
No encryption
|
🔗 Proof
|
University study of Kasa devices read location and usage data via the local protocol; HS103 itself was not tested.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
—
|
Managed through a Kasa/TP-Link account and the Kasa Smart app.
|
| Authentication
|
Basic
|
🔗 Proof
|
Account login for cloud use; local management protocol was unauthenticated; no two-factor authentication found in my search.
|
| Brute-force protection
|
Basic
|
—
|
No public documentation found.
|
| Event logging
|
Partial logging
|
—
|
No public documentation of an access log found.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
Local control requires no password (CVE-2026-108473); cloud access uses the user's own TP-Link account password.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Not disclosed (Companion App: Kasa Smart)
|
| Hardware (CPU / GPU)
|
CPU: Not disclosed • GPU: Not disclosed
|
| Memory & Storage
|
Memory: Not disclosed • Storage: Not disclosed
|
| Power, Battery & Charging
|
Battery: None • Power: 100–120 V AC, 15 A max load • Charging: N/A
|
| Display & Camera
|
Display: None (LED indicators, power/settings button) • Camera: None
|
| Sound & Connectivity
|
Sound: None • Connectivity: Wi-Fi 4 (802.11n), 2.4 GHz only, 1T1R
|
| Physical (Dimensions & Mass)
|
Dimensions: 66.5 × 40.0 × 38.0 mm (H×W×D) • Mass: Not disclosed
|
The Kasa Smart Wi-Fi Plug Mini (HS103) is a low-cost Wi-Fi plug controlled via the Kasa app and TP-Link cloud. In October 2026 TP-Link disclosed an improper-authentication flaw in the local management protocol of several Kasa devices, including HS103, and released firmware fixes. Earlier research on Kasa plugs found an unauthenticated local protocol with weak obfuscation. Positives are active vendor patching and a published security advisory.
Summary：Initial classification of TP-Link Kasa Smart Plug Mini (HS103)
