Loading vulnerability…
Unauthenticated Geolocation Disclosure in TP-Link Kasa EC70 v4 and EC71 v4 Discovery Service
CVE-2026-13230 is an information disclosure vulnerability in the unauthenticated local-discovery response mechanism of TP-Link Kasa EC70 v4 and EC71 v4 cameras. A device on the same local network can use crafted discovery protocol traffic to retrieve sensitive geolocation-related information from an affected camera without authentication.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An adjacent-network attacker can disclose geolocation-related data associated with an affected camera. The reported impact is limited to confidentiality; no integrity modification or availability disruption has been identified.
If you can’t patch tonight, do this now.
Until firmware updates are installed, segment cameras onto a dedicated IoT or guest network, restrict access to the local network to authorized devices, use strong Wi-Fi encryption, and keep router firmware current. These measures reduce the opportunity for an adjacent attacker or compromised local device to reach the discovery service.
Patch, then assume compromise.
Update affected cameras to TP-Link's fixed firmware releases or later. The listed fixed releases are firmware 2.4.0 Build 20260520 rel.4191 for Kasa EC70 v4 and firmware 2.4.1 Build 20260621 rel.76536 for Kasa EC71 v4. Update the Kasa mobile application to the latest version as recommended by the vendor.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.