TP-Link Kasa KP125M Smart Plug

TP-Link Kasa KP125M Smart Plug
Security Grade C Calculator v1	TP-Link Kasa KP125M Smart Plug Brand: TP-Link (Kasa Smart) Category: Smart Wi-Fi plug with energy monitoring, Matter-certified • Model / Gen: KP125M (US V1.6) Release Date: 2023-04-07 • Status: In sale Classification Date: 2026-10-23 • [www.tp-link.com/en/home-networking/smart-plug/kp125m/ Official Website]

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[www.tp-link.com/en/home-networking/smart-plug/kp125m/ 🔗 Proof]	documentary assessment, NOT device testing: sealed consumer plug; no publicly documented exposed debug/JTAG interface or widespread physical tampering for this model; conclusion limited to public product documentation, no teardown performed.
Known vulnerabilities	Rare	[services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-46549 🔗 Proof]	documentary assessment, NOT device testing: two published CVEs (CVE-2024-46548 improper certificate validation/MITM; CVE-2024-46549 device identity impersonation on MQTT/API) affect firmware v1.0.3 only and were patched in KP125M 1.2.3 Build 240624 (2024-07-26); limited, disclosed and fixed, not a history of recurring flaws.
Prior attacks	Rare	[github.com/Chapoly1305/tp-link-cve/blob/main/CVE-2024-46549.md 🔗 Proof]	documentary assessment, NOT device testing: researcher PoC/responsible-disclosure writeups only; no publicly observed in-the-wild mass compromise or botnet campaign specific to KP125M; SSVC marks exploitation as PoC, not active.
Updatability	Very common	[www.tp-link.com/en/support/download/kp125m/ 🔗 Proof]	documentary assessment, NOT device testing: official KP125M V1 download page Firmware Release Note shows continuous OTA for KP125M(US)_V1.6, latest 1.4.1 Build 260721 published 2026-08-03 (Matter 1.3, stability and security fixes); vendor actively ships patches for this exact model.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Full	[static.tp-link.com/upload/manual/2024/202407/20240718/1910013749_KP125M(2-Pack)(US)_UG_V3.pdf 🔗 Proof]	documentary assessment, NOT device testing: setup requires a bound TP-Link ID account; device binds to account and integrates into authenticated Matter fabrics with setup codes; old MITM unbind issue (CVE-2024-46548) was fixed in 1.2.3; conclusion scoped to documented cloud/Matter binding, local-only use not tested.
Communications	Encrypted with up-to-date encryption	[www.tp-link.com/us/support/faq/4336/ 🔗 Proof]	documentary assessment, NOT device testing: official TP-Link/Tapo-Kasa ecosystem statement cites AES-128 and TLS 1.2 for cloud traffic; the device uses authenticated MQTT to TP-Link cloud (CVE writeup); certificate validation flaw in v1.0.3 was fixed in 1.2.3; scope limited to documented cloud channel, LAN-only protocol not assessed here.
Storage	No encryption	[static.tp-link.com/upload/manual/2024/202407/20240718/1910013749_KP125M(2-Pack)(US)_UG_V3.pdf 🔗 Proof]	documentary assessment, NOT device testing: no vendor documentation describes at-rest encryption of on-device configuration/Wi-Fi credentials; stored data on the plug itself is minimal (schedules, energy metadata mirrored to cloud); absence of documented encryption rather than verified plaintext extraction.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	[static.tp-link.com/upload/manual/2024/202407/20240718/1910013749_KP125M(2-Pack)(US)_UG_V3.pdf 🔗 Proof]	documentary assessment, NOT device testing: all account life-cycle (register, recover, share, remove device) lives in the TP-Link ID cloud account; the plug has no on-device local user directory; rated Basic because administration is external to the device.
Authentication	Basic	[www.tp-link.com/us/support/faq/4336/ 🔗 Proof]	documentary assessment, NOT device testing: access relies on TP-Link ID password over cloud TLS; optional 2FA exists at ecosystem level but is not enforced by the plug; no device-local authentication factor documented; rated Basic rather than Secure based on public docs alone.
Brute-force protection	Absent	[www.tp-link.com/en/home-networking/smart-plug/kp125m/ 🔗 Proof]	documentary assessment, NOT device testing: no device-side lockout, rate-limiting or anti-brute-force control is documented for the plug; any throttling would be server-side TP-Link ID controls outside this device's scope; marked Absent because none is evidenced for the device itself.
Event logging	Partial logging	[static.tp-link.com/upload/manual/2024/202407/20240718/1910013749_KP125M(2-Pack)(US)_UG_V3.pdf 🔗 Proof]	documentary assessment, NOT device testing: the official User Guide documents on/off control and energy-history telemetry in the app, but provides no security access audit log (who changed control, session records); partial operational logging only.
Passwords	Require change after setup	[static.tp-link.com/upload/manual/2024/202407/20240718/1910013749_KP125M(2-Pack)(US)_UG_V3.pdf 🔗 Proof]	documentary assessment, NOT device testing: no default/shared device password; credentials are the user-chosen TP-Link ID password created at registration under account complexity policy; no on-device forced-complexity routine beyond the cloud account.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded Kasa firmware (Linux-based; Matter-certified stack) (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass: