You do not have permission to edit this page, for the following reasons:
==Device Overview== * Manufacturer: TP-Link * Model Number: HS110 * Firmware Versions affected: 1.5.0 and earlier * Use-case: Wi-Fi smart power plug, energy monitoring, remote on/off control. ==Vulnerabilities & Attack Surface== * CVE ID: CVE-2020-8328 * Vulnerability description: The local communication protocol uses weak XOR encryption. LAN attackers can sniff and forge control commands. * Attack vector: Adjacent network (LAN). ==CIA Triad Impact Analysis== * Confidentiality: Power usage data and device token intercepted. * Integrity: Attacker toggle outlet state arbitrarily. * Availability: Flood forged commands to crash device service. ==Mitigations / Countermeasures== * 1. Apply latest TP-Link firmware update. * 2. Isolate IoT devices on separate VLAN. * 3. Avoid exposing plug to internet port forwarding. * 4. Use cloud authentication only over TLS. ==References== [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8328 [2] TP-Link security notice for HS series
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
