Kasa Smart Plug 4-Pack in 2026: What the TP-Link Rules Cover, and Which Model to Buy

No United States rule bans Kasa smart plugs. The FCC's March 2026 order covers foreign-produced consumer routers and explicitly leaves other device categories undecided.

The regulatory story around TP-Link is real, and it is narrower than most of the headlines suggest. The Commerce Department proposed banning TP-Link routers on 30 October 2025. The White House shelved that federal ban on 18 February 2026. The FCC then added foreign-produced consumer-grade routers to its Covered List on 23 March 2026. None of those actions bans a smart plug, and anyone telling you otherwise is guessing. What they do establish is that the company making the Kasa range is under sustained government scrutiny, which changes how you should think about a device that will sit on your home network for a decade.

Where the rules stand on 1 September 2026

• 30 October 2025: Commerce proposes banning TP-Link routers on national-security grounds, backed by Justice, Defense and Homeland Security
• 18 February 2026: the White House shelves the proposed federal ban ahead of a Trump-Xi summit
• 23 March 2026: the FCC adds foreign-produced consumer routers to its Covered List; the order is not retroactive
• Previously authorised routers keep software and firmware updates through 1 March 2027
• Smart plugs are not covered, and the FCC has not said whether it will extend the list to them

One shelf label, three different plugs

The phrase Kasa Smart Plug 4-Pack does not identify a product. It identifies at least three. The EP25 is the Kasa Smart Wi-Fi Plug Slim with Energy Monitoring, sold in fours as the EP25P4. The HS103P4 is the older Plug Mini in a four-pack, with no energy monitoring. The KP125M is a third device, also called a Plug Slim with Energy Monitoring, and it is the Matter-certified one, sold in two-packs and four-packs. Reviews that treat these as interchangeable are comparing different hardware with different capabilities.

TP-Link’s own EP25 page gives the specification but no price, and its Buy Now button for the four-pack points at Amazon. On 1 September 2026 B and H listed the EP25P4 in stock at 41.99 dollars against a 44.99 list. The EP25 itself is rated 100 to 120VAC at 15A, with a maximum load of 1.8kW at 120V, measures 2.61 by 1.49 by 1.57 inches, is UL certified, carries a two-year warranty, and reports real-time and historical energy use in the Kasa app.

The HS103P4 is harder to pin down. Its TP-Link US page still resolves and carries no end-of-life notice, but the page body returned no specifications, price or compatibility information when we fetched it, so treat its current sale status as unconfirmed rather than assuming either way.

What the FCC order says, and the four words that matter

On 23 March 2026 the FCC added consumer-grade routers produced in a foreign country to its Covered List. The law firm Crowell’s client alert on the order describes the scope as deliberately broad: any major stage of the manufacturing process outside the United States, including manufacturing, assembly, design and development. Commerce named three Chinese-linked intrusion campaigns, Salt Typhoon, Flax Typhoon and Volt Typhoon, as its reason.

Two provisions matter to anyone who already owns TP-Link hardware. The order is not retroactive, so routers already on the US market or already holding FCC authorisation are unaffected, and previously authorised routers continue to receive software and firmware updates through 1 March 2027. Manufacturers can also apply for an 18-month Conditional Approval through the Department of Homeland Security or the Department of War.

The four words that decide this article are Crowell’s own: it is unclear whether the FCC will take further action on additional categories of devices, which the alert lists as including IoT cameras, video recorders and storage. Smart plugs are not on the Covered List. No rule prevents you buying, owning or using a Kasa plug today, and the question of whether that changes is open rather than answered.

The proposal that was shelved and the lawsuit that was not

The Commerce proposal of 30 October 2025, reported by Tom’s Hardware, was supported by the Justice, Defense and Homeland Security departments and cited TP-Link’s close ties to China along with the risk of spyware delivered through mandatory firmware updates. The process was structured as two 30-day phases, with TP-Link responding before Commerce decided.

TP-Link’s rebuttal deserves fair space. The company vigorously disputes any allegation that its products present national security risks, and draws a line between TP-Link Technologies, the Chinese parent, and TP-Link Systems, a separate United States entity established in 2022, noting that manufacturing has been in Vietnam since 2018. It claims under 10 percent of the North American residential router market, while other reporting has put its overall share at around 65 percent, a gap large enough that both figures should be read as contested.

9to5Mac reported on 18 February 2026 that the White House shelved the federal ban ahead of a Trump-Xi summit, after three separate investigations by Commerce, Defense and Justice had made a ban look likely. State-level action did not stop. The Texas Attorney General’s office sued TP-Link on 17 February 2026 over allegedly deceptive marketing about privacy and security; Attorney General Ken Paxton had opened the underlying investigation in October 2025, and Governor Abbott barred state employees from using TP-Link products in January 2026. Whether Kasa or Tapo products are named in that suit is not stated in the material we could verify.

Microsoft’s botnet numbers are about routers

The most concrete published security finding against TP-Link hardware is Microsoft’s, published on 31 October 2024 and updated on 4 December 2024. Microsoft found that small office and home office routers manufactured by TP-Link make up most of the network it tracks as CovertNetwork-1658, also known as xlogin, Quad7 and 7777, averaging around 8,000 compromised devices active at any time, roughly a fifth of them running password-spraying at any moment and feeding harvested credentials to the Chinese threat actor Storm-0940, active since at least 2021. Microsoft says the operator exploited a vulnerability in the routers to gain remote code execution.

This is a router finding, and it should be reported as one. It is not evidence that Kasa plugs are compromised, and nothing in Microsoft’s write-up says they are. It is, however, the reason the regulatory attention exists, and 9to5Mac notes Microsoft also found compromised TP-Link devices being used against Western think tanks, government bodies, NGOs and Department of Defense suppliers.

The advisory TP-Link expects you to act on

TP-Link’s own security advisory covers CVE-2023-38906, CVE-2023-38908 and CVE-2023-38909, described as insecure local communication vulnerabilities affecting Tapo and Kasa devices and their apps. It was published on 23 August 2023 and last updated on 24 October 2024. The affected model list, the app versions involved and what an attacker could actually do are not enumerated in the advisory, which is a real limitation on how much a buyer can assess.

What the advisory does say clearly is where TP-Link puts the responsibility: the vulnerabilities will remain if you do not take all the recommended actions, which means updating both the device firmware and the app. If you own Kasa plugs and have not opened the app in a year, that is today’s job.

Buy the Matter model instead

The supersession that should decide this purchase is a protocol, not a product number. The EP25 works with Alexa, Google Assistant and Samsung SmartThings, and depends on the Kasa app and a TP-Link cloud account to do it. HomeKit appears in the title of TP-Link’s own EP25 page but is not described anywhere in the feature text, and B and H’s listing names only Alexa, Google Assistant and SmartThings, so treat HomeKit support on the EP25 as unconfirmed until TP-Link states it in prose.

The KP125M is Matter certified, works with Alexa, Apple Siri, Google Assistant and Samsung Bixby, and is set up by scanning a QR code in the Alexa, Google Home or Apple Home app, without installing the Kasa app at all. That is the difference that matters over the ten-year life of a plug in a wall socket.

• A Matter plug keeps working through an app being retired, a cloud service being switched off or a vendor changing hands
• Setup without a vendor account means one less place your home’s data lives
• TP-Link publishes no price on either product page, so compare the two only at a retailer, on the same day
• Neither model supports Thread, and both are 2.4GHz Wi-Fi only, so plan your access point coverage accordingly
• If you are uncomfortable with the company itself rather than the protocol, that is a legitimate reason to buy another brand, and it is a different reason from anything a regulator has actually ruled

Sources: Crowell and Moring · Tom’s Hardware · 9to5Mac · Microsoft Security Blog · Kasa Smart