PT-2025-34709 · Tp Link · Tp-Link Kp303 (Us) Smartplug

Elysee Franchuk · Published 2025-08-25 · Updated 2025-09-30 · CVE-2025-8627

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TP-Link KP303 Smartplug versions prior to 1.1.0

Description: The TP-Link KP303 Smartplug is susceptible to unauthenticated protocol commands that can lead to an unintended power-off condition and potential information leak.

Recommendations: Update the TP-Link KP303 Smartplug to version 1.1.0 or later.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-10692

CVE-2025-8627

Affected Products

Tp-Link Kp303 (Us) Smartplug

References · 14

• https://tp-link.com/us/support/faq/4619 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10692 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-8627 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8627 · Vendor Advisory
• https://t.me/CVEtracker/30872 · Telegram Post
• https://twitter.com/fridaysecurity/status/1960163860519768514 · Twitter Post
• https://t.me/pentestingnews/66916 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1960273932222648611 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1960163404166959338 · Twitter Post
• https://t.me/cveNotify/133367 · Telegram Post
• https://vuldb.com/?id.321390 · Note
• https://t.me/cveNotify/133438 · Telegram Post
• https://twitter.com/Komodosec/status/1973149490019443135 · Twitter Post
• https://twitter.com/CVEnew/status/1960092563655852063 · Twitter Post