Tp Link · Tp-Link Kasa Kp125M · CVE-2024-46549
**Name of the Vulnerable Software and Affected Versions**
TP-Link Kasa KP125M version 1.0.3
**Description**
An issue in the TP-Link MQTT Broker and API gateway allows attackers to establish connections by impersonating devices owned by other users. This impersonation can lead to unauthorized access.
**Recommendations**
For TP-Link Kasa KP125M version 1.0.3, consider restricting access to the MQTT Broker and API gateway until a patch is available. As a temporary workaround, disabling the device impersonation feature can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.