| TP-Link KP303 Smart Plug
|
|
Security Grade
Calculator v
|
TP-Link KP303 Kasa Smart Wi-Fi Power Strip (3-Outlets)
Release Date: 2018-09-14 • Status: End of life
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
|
| Prior attacks
|
Rare
|
🔗 Proof
|
|
| Updatability
|
Rare
|
🔗 Proof
|
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
|
| Storage
|
No encryption
|
🔗 Proof
|
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
|
| Authentication
|
Basic
|
🔗 Proof
|
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
|
| Event logging
|
Partial logging
|
🔗 Proof
|
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
TP-Link Kasa IoT OS (Proprietary Realtek-based) (Companion App: Kasa Smart App)
|
| Hardware (CPU / GPU)
|
CPU: Realtek RTL8710BN (Single-core ARM Cortex-M3 @ 83.3MHz) • GPU:
|
| Memory & Storage
|
Memory: 64KB SRAM • Storage: 1MB Flash ROM
|
| Power, Battery & Charging
|
Battery: • Power: 125VAC / 15A (Max 1875W) • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Wi-Fi 802.11 b/g/n (2.4GHz)
|
| Physical (Dimensions & Mass)
|
Dimensions: 7.3 x 1.7 x 1.5 in (185 x 43 x 39 mm) • Mass: 139 g
|
TP-Link KP303 is a Kasa Smart Wi‑Fi power strip managed through the Kasa app and bound to a TP‑Link ID for cloud and local LAN control, with no local login interface or independent device account. Its security depends mainly on TP‑Link ID credentials, account protections, and the home Wi‑Fi environment. The legacy Kasa Smart Home protocol uses XOR self‑synchronous encryption with an initial key of 171/0xAB, which is not modern strong encryption, while newer Kasa v2 implementations use AES‑128‑CBC with SHA‑256 integrity checking; KP303’s actual protocol version depends on firmware. A high‑severity vulnerability, CVE‑2025‑8627, was disclosed for KP303 v2.0 with firmware before 1.1.0, allowing unauthenticated command execution on the local network and rated 8.7 High under CVSS v4.0; TP‑Link has released patched firmware for affected versions. Overall, KP303 is acceptable for ordinary home automation but not for high‑security environments, and users should update firmware, use a strong TP‑Link ID password, enable available account protections, and keep the device on a trusted 2.4 GHz Wi‑Fi network.
