Kasa Smart

Is Kasa Smart safe?

For smart plugs and light switches, mostly yes, with two conditions: keep the firmware current and keep the devices away from your main Wi-Fi. Kasa is TP-Link's original smart home range and the Kasa Smart app has more than 5 million installs on Google Play. Its App Store label is clean, with no tracking. The problems sit around it. TP-Link disclosed two high-severity Kasa flaws in 2026, its privacy policy covers far more than the label shows, and five US states are suing TP-Link Systems, with complaints naming the Kasa app.

We score Kasa Smart 58/100, one point above its sister app TP-Link Tapo at 57, mainly because Kasa has had far fewer flaws. Smart Life also scores 58.

What were the 2026 Kasa flaws?

Both need an attacker on your local network, and both are fixed by firmware updates.

• CVE-2026-76784 (published August 2026, CVSS 8.7): weak cryptography in Kasa's local control protocol let someone nearby intercept, replay or forge commands, switching devices on or off or knocking them offline.
• CVE-2026-108473 (October 2026, CVSS 8.7): devices accepted management commands without proper authentication. TP-Link's advisory adds that, "under certain conditions", account information could be exposed and the cloud account compromised. It lists fixed firmware for 23 models, from the HS103 plug to the KL125 bulb.

Earlier flaws were in the same vein. In 2024 researchers found that the KP125M plug did not check certificates properly (CVE-2024-46548) and that TP-Link's cloud message broker let an attacker connect while posing as another user's device (CVE-2024-46549). In July 2026 a bug in two Kasa cameras exposed geolocation data on the local network (CVE-2026-13230).

The Kasa app offers two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, which sends a code to your trusted devices or by email when a new phone logs in, but it is off unless you turn it on. TP-Link's policy mentions encryption and TLS but no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary for camera video. We found no public bug bounty for TP-Link on HackerOne or Bugcrowd.

What does the Kasa app collect?

Apple's label lists purchases, financial info, location, contact details, user content, identifiers, usage and diagnostics, all marked as not linked to you, and nothing used for tracking. Google Play's section differs: it says your email address is used for advertising or marketing as well as for the account, and that payment information is shared with other companies.

The Kasa policy, last updated on 26 September 2024, is the same broad TP-Link text used by Tapo. It covers images and video stored with cloud services, your location, device logs and Wi-Fi credentials if you sync them, and phone details such as the IMEI if you join the user experience programme. It allows sharing with service providers including "advertising serving technologies". Data sits on AWS in the US, Ireland and Singapore "among other countries". In Europe, the policy shown to users says data is generally kept for seven years after your contract ends.

Why are US states suing TP-Link?

Texas Attorney General Ken Paxton sued TP-Link Systems in February 2026. According to The Register, the petition says TP-Link's mobile apps collect personal data without informed consent and that "Made in Vietnam" labels misled buyers about how much of its products comes from China. On 6 October 2026, Florida, Iowa, Montana and Nebraska followed. Florida's complaint, filed in the Polk County circuit court under the state's Deceptive and Unfair Trade Practices Act, names Kasa Smart directly: it says the app's US privacy policy has disclosed the collection of email, location and phone identifiers since at least January 2024, but would leave a consumer deceived about the risk of that data being shared with the Chinese government. Florida asks for an injunction and civil penalties of $10,000 per wilful violation, or $15,000 where the victim is a senior, disabled person or service member.

TP-Link calls the suits "built on false premises" and says it does not share customer network data with foreign governments. No court has ruled, so these are allegations, and we score them in the band for pending suits by attorneys general.

How to use Kasa more safely

1. Update every device's firmware in the Kasa app, especially the 23 models in TP-Link's October 2026 advisory.
2. Turn on two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary under Me, View account, Login Security.
3. Put Kasa plugs, bulbs and cameras on a guest or IoT network, since the 2026 flaws need local network access.
4. Skip the user experience programme and use a Kasa Care cloud plan only if you need recorded video.
5. Delete your account at TP-Link's account deletion page if you retire your devices.

How we scored it

Scams and harmful content (77) is Kasa's best factor: plugs and bulbs carry little content risk. Security (52) is the weakest after two high-severity local flaws in 2026 and no public bug bounty, though Kasa has had far fewer flaws than Tapo. Privacy (55) follows TP-Link's broad policy rather than the clean App Store label, and the regulatory record (60) reflects pending state suits that name the app, with no fine.