# CVE-2026-13230: TP-Link Kasa EC70 and EC71 information disclosure in local discovery

Source: https://junglewise.ai/threats/cve-2026-13230-tp-link-kasa-ec70-and-ec71-information-disclosure-in-local  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-13230 · Severity: info · CVSS 5.3 · Published 2026-07-15

TP-Link Kasa smart cameras are used for home security and monitoring. A security flaw in the local discovery feature allows anyone on the same Wi-Fi network to see the camera's precise physical location without needing a password. This could allow an unauthorized person to track the device's location, though it does not allow them to view video feeds or control the camera.

Technologies: [TP-Link Kasa EC70](https://junglewise.ai/threats/technologies/kasa-ec70), [TP-Link Kasa EC71](https://junglewise.ai/threats/technologies/kasa-ec71). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-13230 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13230 being exploited in the wild.

**How severe is CVE-2026-13230?** Informational severity, with a CVSS score of 5.3, published 15 July 2026.

**Which products and versions are affected?** TP-Link Kasa EC70 Before 2.4.1 Build 20260621 rel.76536; TP-Link Kasa EC71 Before 2.4.1 Build 20260621 rel.76536.

**Is there a fix for CVE-2026-13230?** A patch was published on 2026-06-21: Firmware version 2.4.1 Build 20260621 released to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13230 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-13230?** Check whether you run TP-Link Kasa EC70 or TP-Link Kasa EC71 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability (CWE-200) exists in the local discovery mechanism of TP-Link Kasa EC70 v4 and EC71 v4 smart cameras. The flaw allows an unauthenticated attacker located on the same local network (adjacent) to retrieve sensitive geolocation-related data by sending crafted responses to the discovery service. The vulnerability only impacts confidentiality, with no reported impact on device integrity or availability. A fix is available in firmware version 2.4.1 Build 20260621 rel.76536 and later.

## Affected products

- TP-Link Kasa EC70 v4 Before 2.4.1 Build 20260621 rel.76536
- TP-Link Kasa EC71 v4 Before 2.4.1 Build 20260621 rel.76536

## Timeline

- 2026-06-21: patched: Firmware version 2.4.1 Build 20260621 released to address the issue.
- 2026-07-15: advisory: CVE published to the NVD.

## References

- [https://www.tp-link.com/en/support/download/ec70/v4/](https://www.tp-link.com/en/support/download/ec70/v4/)
- [https://www.tp-link.com/en/support/download/ec71/](https://www.tp-link.com/en/support/download/ec71/)
- [https://www.tp-link.com/us/support/download/ec70/v4/](https://www.tp-link.com/us/support/download/ec70/v4/)
- [https://www.tp-link.com/us/support/download/ec71/](https://www.tp-link.com/us/support/download/ec71/)
- [https://www.tp-link.com/us/support/faq/5192/](https://www.tp-link.com/us/support/faq/5192/)

## Related threats

- [TP-Link Kasa EC70 and EC71 v4 debug interface and bootloader bypass](https://junglewise.ai/threats/cve-2026-102370-kasa-ec70-v4-and-ec71-v4-do-not-logically-disable-the-production)
- [TP-Link Kasa EC70 and EC71 hard-coded cryptographic key](https://junglewise.ai/threats/cve-2026-9770-tp-link-kasa-ec70-and-ec71-hard-coded-cryptographic-key)