Loading story…
TP-Link has patched two vulnerabilities in Kasa EC70 v4 and EC71 v4 cameras, including the high-severity CVE-2026-9770 flaw caused by a hardcoded private cryptographic key embedded in firmware. Because the same static key was stored in a read-only filesystem and shared across devices, an unauthenticated attacker on the same local network could extract it from the firmware image and use it against the cameras’ web management service, undermining the confidentiality of encrypted communications. The issue could enable passive traffic decryption, machine-in-the-middle interception, and capture of administrative credentials.
TP-Link also fixed CVE-2026-13230, a lower-severity information disclosure bug that can reveal geolocation data through the devices’ local discovery mechanism without authentication. The affected products are vulnerable on firmware versions earlier than 2.4.0 Build 20260520 rel.4191, and the company said it has found no evidence of active exploitation or any public proof-of-concept. Because both flaws require local network access, the exposure is most relevant to shared Wi-Fi environments or compromised devices already inside the network; users are advised to update camera firmware and the Kasa mobile app and to isolate IoT devices on a guest or segmented network.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting said TP-Link had also patched CVE-2026-13230, which can expose geolocation data through local discovery without authentication. TP-Link said it had found no evidence of in-the-wild exploitation and that no public proof-of-concept was available.
A hardcoded private key vulnerability affecting TP-Link Kasa EC70 v4 and EC71 v4 cameras was publicly disclosed as CVE-2026-9770. The flaw could let an unauthenticated attacker on the same network decrypt communications or conduct man-in-the-middle attacks against the web management service.
TP-Link patched two information disclosure vulnerabilities affecting Kasa EC70 v4 and EC71 v4 cameras, including CVE-2026-9770 and CVE-2026-13230. The fixes are present in firmware versions 2.4.0 Build 20260520 rel.4191 and later for the affected products.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourcetp-link.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TP-Link disclosed **CVE-2026-76784**, a high-severity vulnerability (CVSS v4.0 **8.7**) in the local communications protocol used by multiple Kasa smart-home devices. Insufficient cryptographic protections allow an attacker on the same local or wireless network to intercept, replay, or forge device-control messages without authentication, privileges, or user interaction, potentially affecting smart plugs, switches, lights, and related products. An attacker could change device states without authorization, disrupt connected appliances, or cause denial-of-service conditions. TP-Link has issued model-specific firmware updates through the Kasa application; users should install the update applicable to their exact hardware version and isolate IoT devices from guest and less-trusted networks until remediation is complete. No confirmed exploitation in the wild or public proof of concept has been reported.
Aug 27, 2026
TP-Link patched a high-severity authentication bypass vulnerability in its *VIGI* surveillance camera product line that allows an attacker with **local network (LAN) access** to reset the administrator password and take full control of affected devices. Tracked as **CVE-2026-0629** (CVSS v4.0 **8.7**), the issue is in the cameras’ local web interface **password recovery** workflow, where improper reliance on **client-side state** enables password reset without verification, requiring no privileges or user interaction. Successful exploitation can enable attackers to access or manipulate live/recorded video, change configurations, disable security features, and potentially use compromised cameras as a pivot for lateral movement or botnet/DDoS activity. Reporting attributes the discovery to **Arko Dhar (Redinent Innovations)** and notes broad model impact across VIGI C and VIGI InSight lines (reported as 28 series in one account and 32+ models in another); one researcher assessment identified **2,500+ internet-exposed** potentially vulnerable devices from checks of a single model, suggesting wider exposure where cameras are reachable from the internet despite the LAN-oriented attack vector.
Jun 29, 2026
TP-Link has disclosed and patched a high-severity authenticated command injection flaw, **CVE-2026-5509**, affecting **Archer BE450 v1** and **BE7200 v1** routers. The vulnerability in the web management interface carries a **CVSS 8.5** score and can let an attacker who has already gained administrative access execute arbitrary system commands, potentially leading to elevated privileges, configuration tampering, unauthorized service execution, and interception of sensitive network traffic. TP-Link said devices running firmware earlier than **`1.3.0 Build 20260416`** are vulnerable and urged customers to install the latest firmware from its regional support portals. The disclosure follows broader reporting on security weaknesses affecting **TP-Link Archer NX** routers, adding to concerns over exploitable flaws in the vendor’s consumer networking lineup. Together, the reports highlight continued risk in internet-facing router management functions, where compromised credentials or prior access can turn web interface bugs into full device compromise. Organizations and home users using affected Archer models should verify firmware versions, restrict administrative access, and apply vendor updates immediately.
Jun 29, 2026