TP-Link Patches Kasa Camera Flaws Exposing Credentials and Location Data

TP-Link has patched two vulnerabilities in Kasa EC70 v4 and EC71 v4 cameras, including the high-severity CVE-2026-9770 flaw caused by a hardcoded private cryptographic key embedded in firmware. Because the same static key was stored in a read-only filesystem and shared across devices, an unauthenticated attacker on the same local network could extract it from the firmware image and use it against the cameras’ web management service, undermining the confidentiality of encrypted communications. The issue could enable passive traffic decryption, machine-in-the-middle interception, and capture of administrative credentials.

TP-Link also fixed CVE-2026-13230, a lower-severity information disclosure bug that can reveal geolocation data through the devices’ local discovery mechanism without authentication. The affected products are vulnerable on firmware versions earlier than 2.4.0 Build 20260520 rel.4191, and the company said it has found no evidence of active exploitation or any public proof-of-concept. Because both flaws require local network access, the exposure is most relevant to shared Wi-Fi environments or compromised devices already inside the network; users are advised to update camera firmware and the Kasa mobile app and to isolate IoT devices on a guest or segmented network.