Loading vulnerability…
Shared Static Private Key in TP-Link Kasa EC70 v4 and EC71 v4
CVE-2026-9770 is a hard-coded cryptographic key vulnerability in TP-Link Kasa EC70 v4 and EC71 v4 camera firmware. A static private key is stored in the read-only firmware filesystem and is shared across devices. An attacker able to obtain the firmware image can extract the key and, from the same local network, use it against the device web-management service. The shared key undermines the confidentiality and integrity assurances of the service's encrypted communications.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated adjacent-network attacker may passively decrypt web-management traffic or actively conduct a man-in-the-middle attack. This can expose administrative credentials and enable alteration of management communications; obtained administrative access may enable control of the affected camera and access to its video functions.
If you can’t patch tonight, do this now.
Until firmware updates are deployed, isolate cameras and their management interfaces on a segmented IoT network, prevent untrusted or guest devices from accessing that segment, use strong Wi-Fi encryption, and maintain current router firmware. Restricting local network access reduces the opportunity for an adjacent attacker to intercept or manipulate camera-management traffic.
Patch, then assume compromise.
Update affected cameras to the vendor-provided fixed firmware. Fixed releases listed for the affected models include EC70 v4 firmware 2.4.0 Build 20260520 rel.4191 and EC71 v4 firmware 2.4.1 Build 20260621 rel.76536. Update the Kasa mobile application as well.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.