CVE-2026-76784: tp-link systems inc. ep10 Missing Cryptographic Step

Vulnerability summary

CVE-2026-76784 is a high (CVSS 8.7) Missing Cryptographic Step vulnerability in tp-link systems inc. ep10. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 8.8% of scored vulnerabilities.

Timeline

1. 26-08-2026
   PublishedVulnerability first disclosed.
2. 26-08-2026
   Last modifiedVulnerability information updated.

Description

Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful exploitation could allow an attacker to manipulate the operational state of an affected device, resulting in unauthorized state changes, disruption of normal device functionality or a denial-of-service condition.

• CWE-325Missing Cryptographic StepThe product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.