TP-Link KP303 Smartplug Unauthenticated Command Vulnerability Leading to Power Loss and Information Leak

A vulnerability exists in the TP-Link KP303 Smartplug (US version) prior to firmware 1.1.0, allowing unauthenticated protocol commands to be sent to the device. These commands can cause unintended power-off events and potentially leak information.

Impact

Exploitation of this vulnerability allows for the execution of unauthenticated protocol commands on the device, which can lead to unauthorized power management actions and information disclosure.

Remediation

Users are advised to update the TP-Link KP303 Smartplug to firmware version 1.1.0 or later to address this vulnerability.