Kasa CVE-2026-108473: Patch It, Then Check Third-Party Compatibility

TP-Link posted a security advisory on October 14 for CVE-2026-108473, an authentication flaw in the local management protocol on a long list of Kasa plugs, switches, power strips and bulbs. TP-Link scores it 8.7 out of 10 (High) on CVSS v4.0. The fix is a firmware update. If you only use the Kasa app, Alexa or Google Home, update and move on.

If you run Home Assistant, there's a second step. Newer Kasa firmware can stop talking to Home Assistant until you flip a setting called Third-Party Compatibility in the Kasa app. Here's what I found, and the order I'd do things in.

What the bug actually is

TP-Link's wording: an "unauthenticated adjacent attacker" can send management commands to an affected device without proper authentication, changing its state or its settings. "Adjacent" is the CVSS term for someone on your local network segment, not someone out on the internet. So it's a neighbor on your Wi-Fi, a compromised device on your LAN, or a guest you shouldn't have trusted.

The second half is worse. TP-Link says that under certain conditions involving the app, the device and TP-Link's cloud, account information can be exposed, which "potentially" leads to a compromised cloud account. That's the same TP-Link login that newer Kasa devices use for local authentication with Home Assistant.

Which devices are on the list

TP-Link's table has 23 model and hardware-version rows, each with a fixed firmware version:

• Plugs, switches and strips: HS103 V5, EP10 V1, EP40 V1, HS200 V5, KP401 V1, KS230 KIT V2, KP405 V1, HS220 V3, KP115 V1, HS210 V3, HS300 V2, KP200 V3, KP303 V2, KS200 V1, EP40A V1, KS220, KS200M, ES20M and KS220M V1, KP400 V3.0.
• Bulbs and light strips: KL125 V4, KL135 V2, KL110 V4, KL420L5 V1.

The KS220 and KS200M rows have no hardware version listed. Hardware version matters for everything else, so check the label or the device info in the Kasa app before you decide a row applies to you.

One thing jumped out when I read the build numbers. They look like dates: the plug and switch fixes run from Build 241220 to Build 250908, and the bulb fixes are Build 260605 and Build 260710. If that reading is right (TP-Link doesn't say), most plugs and switches on auto-update got the fix somewhere between late 2024 and fall 2025, and the bulbs only got theirs in June and July 2026. Local Smart Home Guide made the same read on the KS220M build. Either way, don't assume. Check.

Not on the list: the KP125M plug. TP-Link hasn't named it or cleared it.

How to update

Per TP-Link's firmware FAQ, Kasa firmware only updates through the Kasa app: sign in with your TP-Link ID, tap Me > Firmware Update, and leave the device alone until it finishes. There's no browser or manual upload path.

The Home Assistant catch

Home Assistant's TP-Link integration docs say it plainly: "Some firmware versions require explicit activation of third-party integrations before they allow access from Home Assistant." The switch lives under Settings > Third-Party Compatibility in the Kasa app, or Tapo Lab > Third-Party Compatibility in the Tapo app. The same docs note that newer Kasa and Tapo devices need your TP-Link cloud username and password to authenticate even a local session. The integration itself still polls the device locally every five seconds without going through TP-Link's cloud. Local, yes. Account-free, no.

The evidence that the toggle matters is real, if anecdotal. In a TP-Link community thread from October 2025, a user's KP303 V2 on firmware 1.1.2 and KS220M V1 on firmware 1.1.6 dropped out of Home Assistant while still working in the Tapo app. A TP-Link staffer replied that Home Assistant "is not a supported third-party," then pointed to the Third-Party Compatibility switch. The poster turned it on, restarted both devices and Home Assistant, and got control back.

A second user in the same thread had two HS300 strips: one on 1.0.12 worked, and one on 1.1.2 ignored the setting. TP-Link's answer was that the switch is "not a 100% guarantee."

Look at those version numbers next to the advisory. KP303 V2's fix is 1.1.2. HS300 V2's fix is 1.1.2. KS220M V1's fix is 1.1.6. The forum posts don't show build numbers and nobody at TP-Link ties the Home Assistant breakage to the CVE fix, so this is the same firmware family, not proven cause and effect. Still, I'd expect anyone who patches for this CVE to run into the toggle.

Then there's a closed Home Assistant docs issue from September: a KP125M on firmware 1.4.1 needed the same toggle. The fix was a docs change that made the guidance apply to Kasa and Tapo devices generally, instead of reading like a Tapo-camera quirk. No code changed.

The advice I'd skip

The same Home Assistant docs suggest that if you have an older device that doesn't require authentication yet, you "may consider disabling automatic firmware updates to keep it that way." I understand why. With an 8.7-rated authentication flaw in the local protocol, though, freezing old firmware to keep an unauthenticated local API sounds like keeping exactly the problem TP-Link just described. I'd patch. The docs' other alternative, factory resetting and blocking the device from the internet, is a fine way to keep TP-Link's cloud out of the picture, but it isn't a fix for the CVE.

What I'd do this week

1. Inventory. List every Kasa device with model and hardware version, and compare against TP-Link's table.
2. Update from the Kasa app: Me > Firmware Update.
3. Turn on Third-Party Compatibility before Home Assistant complains, not after.
4. Restart any device that went unavailable, then restart Home Assistant. If the integration asks for credentials again, the username is your case-sensitive TP-Link email.
5. Change your TP-Link password. The advisory mentions account exposure, and that login is now doing double duty as your local key.
6. Still broken? The HS300 case says it can happen. Turn on debug logging for homeassistant.components.tplink and kasa (the docs show the logger: block) and file an issue with the logs.
7. Segment your network. An "adjacent" attack needs someone on the same network. Putting plugs and bulbs on their own IoT network or VLAN shrinks that group a lot.

The bigger lesson here isn't about Kasa specifically. "Works with Home Assistant locally" can depend on a vendor setting you didn't know existed, and a security update is exactly when you find out. On any TP-Link device, I'd flip that toggle the day I set it up.