# CVE-2026-108473: Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices

> Unauthenticated adjacent attackers can modify device settings and potentially expose account information due to improper authentication in TP-Link Kasa devices.

- **Severity:** High 8.7 (`CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 14 Oct 2026
- **Updated:** 14 Oct 2026
- **Also known as:** GHSA-jmmx-r2fg-mcgh

## What is CVE-2026-108473?

CVE-2026-108473 is a high-severity missing authorization vulnerability in TP-Link Systems Inc. EP10 v1, published on 14 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

Multiple
Kasa devices contain an improper authentication vulnerability in the local
device-management protocol. An unauthenticated adjacent attacker may send
management instructions to an affected device without adequate authentication
or authorization, allowing modification of the device state or management
settings. Under certain usage conditions involving interaction between the
user, mobile application, and device-cloud service, insufficient protection of
account-related communications may also expose account information.

Successful
exploitation may allow an unauthenticated adjacent-network attacker to perform
unauthorized device-management actions and disrupt legitimate user control.
Under certain conditions, account-related information may also be exposed,
potentially leading to compromise of the associated cloud account.

Weakness: CWE-306 (Missing Authentication for Critical Functionality)

## Which versions are affected by CVE-2026-108473?


## How do I fix CVE-2026-108473?

No fix has been published for CVE-2026-108473 yet. Limit exposure of the affected software until one is available.

## Is CVE-2026-108473 being exploited?

There is no known exploitation of CVE-2026-108473 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-108473 and fix it if it is affected.

What it is: CVE-2026-108473 is a high-severity missing authorization vulnerability in TP-Link Systems Inc. EP10 v1, published on 14 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-108473 in the wild and no public exploit code.

Affected product: TP-Link Systems Inc. EP10 v1. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-108473/ (Markdown: https://insights.sbomify.com/CVE-2026-108473/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-108473
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-108473
- OSV: https://osv.dev/vulnerability/CVE-2026-108473

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-108473/
Summaries are generated and may contain mistakes; the official description above is the record.