(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
| TP-Link Kasa Smart Plug Mini
|
|
Security Grade
Calculator v
|
TP-Link Kasa Smart Plug Mini
Release Date: 2018-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
🔗 Proof
|
No physical tampering reports
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
CVE-2026-76784 and CVE-2026-108473 disclosed
|
| Prior attacks
|
None
|
🔗 Proof
|
No known real-world exploitation
|
| Updatability
|
Rare
|
🔗 Proof
|
Firmware updates are infrequent
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
Local protocol has insufficient authentication
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
CVE-2026-76784: local control messages can be replayed/forged
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Cloud data over HTTPS
|
| Category Score
|
Score: 1 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Kasa account required for remote control
|
| Authentication
|
Basic
|
🔗 Proof
|
CVE-2026-108473: improper auth and credential exposure
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
Basic cloud account protection
|
| Event logging
|
Access event logged
|
🔗 Proof
|
Plug has no built-in logging
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
Local protocol uses weak obfuscation instead of strong auth
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded (Companion App: Kasa Smart)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity:
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
The TP-Link Kasa Smart Plug HS105 is a simple relay device with limited functionality, inherently reducing attack surface. However, CVE-2026-76784 documents insufficient cryptographic protections in the local communication protocol, allowing adjacent-network attackers to replay or forge control messages. CVE-2026-108473 covers improper authentication and credential exposure. The device requires cloud connectivity for remote control with no local-only mode. While physical impact is limited (worst case: unauthorized on/off), the weak local security posture and infrequent firmware updates are concerning. Overall risk is moderate-low due to narrow functionalit
