CVE-2026-76784: CWE-325: Missing Cryptographic Step in TP-Link Systems Inc. HS103P3 / HS103P4 v5

CVE-2026-76784 describes a vulnerability in TP-Link Systems Inc. Kasa smart home devices HS103P3 and HS103P4 version 5, where the local device communication protocol lacks adequate cryptographic protections (CWE-325). This deficiency enables an attacker on the same network segment to intercept, replay, or forge control messages exchanged locally. Successful exploitation may allow unauthorized manipulation of device operational states, potentially disrupting normal functionality or causing denial-of-service conditions. The CVSS 4.0 score is 8.7 (high severity), reflecting the ease of attack and high impact on confidentiality, integrity, and availability. No patch or official remediation has been disclosed as of the publication date.

An adjacent network attacker can intercept and manipulate local control messages to the affected devices, leading to unauthorized device control. This can result in unauthorized state changes, disruption of device functionality, or denial-of-service conditions. The vulnerability affects confidentiality, integrity, and availability of the device's operation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit network access to trusted devices and isolate smart home devices on segmented networks to reduce exposure to adjacent network attackers.