Kasa Smart Plug & Camera Vulnerability: CVE-2026-9770 Explained
For homeowners relying on Kasa indoor cameras to monitor nurseries or living rooms, a recent security disclosure has shifted the conversation from convenience to critical risk. TP-Link has issued urgent firmware patches following the discovery of two vulnerabilities that could allow local attackers to intercept administrative credentials and pinpoint a user’s exact physical location.
Quick Answer: TP-Link has patched two critical vulnerabilities (CVE-2026-9770 and CVE-2026-13230) affecting Kasa EC70 and EC71 v4 cameras. These flaws allow local attackers to intercept admin credentials and access precise home GPS coordinates. Owners must update to firmware version 2.4.1 or higher immediately to mitigate these risks.
| CVE ID | CVSS 3.1 Score | Severity | Impact Vector | Primary Risk |
|---|---|---|---|---|
| CVE-2026-9770 | 8.6 | High | Local Network | Credential Theft / MITM |
| CVE-2026-13230 | 5.3 | Medium | Local Network | Geolocation Data Leak |
What happened
Related: Eufy Home Assistant Integration: Fixing 2026 Motion Push Failures · Reolink CVE-2026-57473 Advisory: Critical Home Hub Patch Released · Wired vs. Wireless Security Cameras for Apartments: 2026 Guide
In July 2026, security researchers disclosed two major vulnerabilities affecting the TP-Link Kasa ecosystem, specifically the EC70 v4 and EC71 v4 indoor cameras. These devices, which are popular for their affordability and integration with the Kasa smart home app, were found to possess architectural flaws that compromise both the digital security of the user’s account and the physical privacy of their home address.
The discovery highlights a significant oversight in how TP-Link manages cryptographic security across its product lines. According to the disclosure reports, the vulnerability stems from a “piecemeal” patching approach; TP-Link fixed a similar issue in its smart plug line as far back as 2020 but failed to apply the same architectural hardening to its camera line until this 2026 intervention.
Fixed firmware versions are now available for the affected models. Owners should verify they are running version 2.4.0 Build 20260520 for the EC70 v4 and version 2.4.1 Build 20260621 for the EC71 v4.
The Hardcoded Key Crisis (CVE-2026-9770)
CVE-2026-9770 is the more severe of the two flaws, carrying a CVSS score of 8.6. This vulnerability involves the use of hardcoded cryptographic RSA keys that are shared across the entire fleet of affected EC70 and EC71 v4 devices. In a secure implementation, each individual device should generate its own unique keys or use a robust certificate-based authentication system to encrypt communications.
By using a shared, hardcoded key, TP-Link inadvertently allowed anyone who could extract the key from one camera to potentially decrypt the traffic of any other camera of the same model. This enables a Man-in-the-Middle (MITM) attack. If an attacker is on the same local network—perhaps through a compromised guest Wi-Fi or another insecure IoT device—they can intercept the “handshake” between the Kasa app and the camera. During this process, administrative credentials and session tokens are transmitted; with the hardcoded key, these can be decrypted, giving the attacker full control over the camera settings and live feed.
The GPS Leak: Why Your Camera Knows Your Address (CVE-2026-13230)
CVE-2026-13230 represents a medium-severity geolocation leak. Security researchers found that the device’s local discovery mechanism, which operates on UDP port 9999, responds to unauthenticated requests with a data packet containing the precise GPS coordinates of the device.
This discovery protocol is intended to help the Kasa app find cameras on a local network during setup. However, the camera was found to be storing and broadcasting the latitude and longitude coordinates provided by the smartphone during the initial configuration. Because this response does not require a password or any form of authentication, any device on the local network can “ping” the camera and receive the exact physical address of the home.
Firmware Version Comparison
| Model | Status | Vulnerable Version | Fixed Version (July 2026) |
|---|---|---|---|
| Kasa EC70 v4 | Vulnerable | < 2.4.0 | 2.4.0 Build 20260520 |
| Kasa EC71 v4 | Vulnerable | < 2.4.1 | 2.4.1 Build 20260621 |
[Image Spec: A Kasa EC71 indoor camera sitting on a wooden bookshelf in a living room, with a semi-transparent digital overlay showing a network packet capture and a GPS coordinate pin hovering over the device.]
Why it matters for buyers
For those currently shopping for indoor security cameras, the CVE-2026 disclosures provide a window into the long-term support and security philosophy of TP-Link. While Kasa cameras often top “best budget” lists due to their low entry price and reliable app performance, these vulnerabilities suggest a reactive rather than proactive approach to security.
The ‘Piecemeal’ Patching Problem
The most concerning aspect of this incident is the “brand reputation” risk. The hardcoded key issue is not a new concept in IoT security. In fact, TP-Link faced similar scrutiny in 2020 regarding its smart plugs (specifically the HS100 and HS110 models), where researchers found weak encryption methods. The fact that the same architectural flaw—using static, shared keys—persisted in the camera line until 2026 suggests that security fixes are not being audited across the entire TP-Link ecosystem.
When a manufacturer fixes a bug in one product but leaves it open in another, it creates a “security debt” that eventually comes due. For a buyer, this means that even if the EC70 is “fixed” today, other devices in the same ecosystem may still harbor similar legacy flaws. This deviates from industry leaders like Google (Nest) or Arlo, which typically maintain more unified security architectures across their product stacks and adhere to strict 90-day disclosure windows for vulnerabilities.
Physical Privacy vs. Digital Security
Most users view a “hack” as a digital inconvenience—someone might see their video feed. However, CVE-2026-13230 bridges the gap between digital and physical risk. Unlike a standard data breach where an email address is leaked, a GPS leak from an indoor camera provides an attacker with the physical location of the device.
This is particularly dangerous when combined with local network access. An attacker who has gained access to a home’s Wi-Fi (perhaps through a weak router password or a compromised smart lightbulb) can use the camera to confirm the home’s exact coordinates. This data can be cross-referenced with property records or used for targeted physical crimes.
Furthermore, research into these Kasa models shows a “second-hand trap.” Standard factory resets on the EC70 and EC71 v4 may not fully purge the stored GPS coordinates from the device’s non-volatile memory. If a user sells their camera on eBay or Facebook Marketplace without a deep firmware wipe, the new owner (or a malicious buyer) could potentially retrieve the previous owner’s home address by querying the discovery port.
Impact on existing owners
If you currently have a Kasa EC70 or EC71 v4 in your home, the risk is immediate but manageable. These vulnerabilities primarily affect the confidentiality and integrity of your security system. While an attacker cannot necessarily “brick” or destroy the camera through these flaws, they can effectively bypass the “security” part of the security camera.
How to Check Your Firmware Version
To determine if your hardware is at risk, you must check both the hardware version and the current firmware build within the Kasa Smart app.
- Open the Kasa Smart App: Ensure you are using the latest version of the app from the iOS App Store or Google Play Store.
- Select Your Camera: Tap on the device tile for your EC70 or EC71.
- Access Settings: Tap the gear icon in the top right corner.
- Device Info: Look for “Hardware Version.” If it says v4, you are affected.
- Check Firmware: Tap “Firmware Update.” If your version is lower than 2.4.1, the app should prompt you to update.
The Risk of Lateral Movement
A critical concept for owners to understand is “lateral movement.” Because both CVE-2026-9770 and CVE-2026-13230 require the attacker to be on the same local network, many users assume they are safe if their Wi-Fi password is strong. However, modern homes are filled with “low-security” IoT devices—cheap smart plugs, no-name LED strips, or older smart appliances—that rarely receive security updates.
If an attacker compromises a $10 smart bulb, they are now “inside” your network. From that vantage point, they can exploit the Kasa vulnerabilities to move laterally to your cameras. Once they have intercepted your admin credentials via the RSA key flaw, they gain full access to:
- Live Video Feeds: Real-time monitoring of your home.
- Cloud Storage: Access to recorded clips stored in Kasa Care.
- Account Settings: The ability to disable motion alerts or delete footage.
What to do now
If you intend to keep your Kasa hardware, you must take active steps to harden your environment. The “set it and forget it” approach is no longer viable for these specific models.
Hardening Your Home Network
The most effective way to protect against local network vulnerabilities is Network Segmentation. Most modern consumer routers (from brands like Asus, TP-Link/Archer, and Netgear) support a “Guest Network” feature.
Basic IoT Segmentation Strategy:
- Create a Guest SSID: Set up a secondary Wi-Fi network specifically for IoT devices.
- Isolate the Network: In the router settings, ensure “AP Isolation” or “Allow guests to see each other” is turned OFF.
- Move Kasa Devices: Connect all Kasa cameras and plugs to this Guest network.
- Keep Personal Devices Separate: Keep your primary phones, laptops, and NAS drives on the main network.
By doing this, even if a Kasa camera is “queried” for its GPS data or its credentials are intercepted, the attacker is trapped on the isolated guest segment and cannot access your sensitive personal data.
Total Cost of Ownership (TCO) Analysis
When deciding whether to stick with the Kasa ecosystem or move to a more secure alternative, it is helpful to look at the three-year total cost of ownership. Kasa cameras are inexpensive upfront, but the long-term “cost” includes both subscription fees and the “security tax” of managing vulnerabilities.
| Cost Component | Kasa EC71 (Pan/Tilt) | Reolink E1 Pro (Alternative) |
|---|---|---|
| Hardware Price | Around $30-35 | Around $50-55 |
| Subscription (3 Years) | ~$90 (Kasa Care) | $0 (Local Storage) |
| Storage Type | Cloud-Primary / MicroSD | MicroSD / NVR / FTP |
| 3-Year Total Cost | ~$125 | ~$55 |
Note: Kasa Care is generally required for person detection and rich notifications, costing approximately $3/month per camera as of mid-2026.
When to Replace Your Hardware
If the recurring architectural flaws in TP-Link’s software have broken your trust, it may be time to transition to a vendor with a more robust security track record. We recommend replacing the hardware if:
- You use the camera in a highly sensitive area (e.g., a bedroom or a room where private financial conversations occur).
- Your router does not support network segmentation or VLANs.
- You are unwilling to pay for a Kasa Care subscription, as the local-only features of Kasa cameras are often more limited than competitors.
A Reliable Alternative: The Reolink E1 Pro
For those looking to exit the Kasa ecosystem, the Reolink E1 Pro offers a compelling alternative in the “under $100” price band. Unlike Kasa, Reolink focuses heavily on local-first storage and provides more granular control over network protocols.
- Security: Reolink supports RTSP and ONVIF, allowing you to use the camera with third-party software like Blue Iris or a local NVR, effectively cutting off the camera’s need to talk to the cloud entirely.
- Resolution: The E1 Pro typically offers 2K (4MP) resolution, a significant step up from the 1080p found on the Kasa EC70/71.
- Privacy: Reolink’s business model is less dependent on recurring subscriptions, meaning they have less incentive to “lock” security features behind a cloud paywall.
Decision Framework: Should You Stay or Go?
- If you are a Renter on a budget: Stay with Kasa, but update the firmware immediately and use a dedicated Guest Wi-Fi. The low entry cost is hard to beat for temporary housing.
- If you are a Homeowner with a nursery: Consider replacing. The risk of a GPS leak and credential theft is significantly higher when the camera is monitoring a child. A local-only or higher-tier encrypted system (like Eufy with HomeKit or Reolink) is a safer bet.
- If you are a Small Business: Replace. The lack of robust administrative auditing and the vulnerability to local MITM attacks make Kasa v4 cameras a liability for commercial environments where guest Wi-Fi is frequently shared.
Frequently Asked Questions
Does this vulnerability allow hackers to watch my camera over the internet?
Not directly. CVE-2026-9770 and CVE-2026-13230 require the attacker to be on your local Wi-Fi network. However, if an attacker steals your admin credentials using these flaws while on your Wi-Fi, they can then log into your account from anywhere in the world to watch your feed.
Will a factory reset fix the GPS leak?
A factory reset will stop the camera from broadcasting your current coordinates once you set it up again with a new (fixed) firmware. However, there is evidence that legacy coordinates may remain in the device’s deep memory. If you are selling the device, it is recommended to update to the latest firmware before performing the final factory reset.
Is the Kasa EC70 v2 or v3 affected?
The current disclosure specifically identifies the v4 hardware revision of the EC70 and EC71. Older versions use different chipsets and internal architectures. However, it is always best practice to check for firmware updates regardless of the version you own.
Sources
- TP-Link Kasa Security Advisory (July 2026)
- CVE-2026-9770 Detail (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2026-9770
- CVE-2026-13230 Detail (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2026-13230
- Reolink E1 Pro Product Specifications — https://reolink.com/product/e1-pro/
- TP-Link Privacy Policy (Last Updated May 2026)