CVE-2026-76784

The record

Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful exploitation could allow an attacker to manipulate the operational state of an affected device, resulting in unauthorized state changes, disruption of normal device functionality or a denial-of-service condition.

Affected packages

Related vulnerabilities

• CVE-2026-25250 EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic… CWE-325
• CVE-2026-58638 Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass… CWE-325
• CVE-2026-55144 Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform… CWE-325
• CVE-2026-6458 Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results… CWE-325
• CVE-2026-49440 Deno is a JavaScript, TypeScript, and WebAssembly runtime. CWE-325
• GHSA-9xg4-qhm4-g43w Deno: Miller-Rabin Primality Test Allows Zero Rounds CWE-325
• CVE-2026-9266 A Missing Required Cryptographic Step vulnerability has been identified in Moxa's… CWE-325
• CVE-2026-45446 Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452)… CWE-325