# CVE-2026-9770: TP-Link Kasa EC70 and EC71 hard-coded cryptographic key

Source: https://junglewise.ai/threats/cve-2026-9770-tp-link-kasa-ec70-and-ec71-hard-coded-cryptographic-key  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-9770 · Severity: info · CVSS 8.6 · Published 2026-07-15

TP-Link Kasa smart security cameras contain a security flaw where a secret digital key used to protect communications is identical across all devices of the same model. An attacker who extracts this key from the camera's software can intercept or spy on the video feeds and management traffic of other cameras on the same local network. This could lead to a significant loss of privacy and unauthorized access to the camera's management interface.

Technologies: [TP-Link Kasa EC70](https://junglewise.ai/threats/technologies/kasa-ec70), [TP-Link Kasa EC71](https://junglewise.ai/threats/technologies/kasa-ec71). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-9770 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9770 being exploited in the wild.

**How severe is CVE-2026-9770?** Informational severity, with a CVSS score of 8.6, published 15 July 2026.

**Which products and versions are affected?** TP-Link Kasa EC70 Before 2.4.0 Build 20260520 rel.4191; TP-Link Kasa EC71 Before 2.4.0 Build 20260520 rel.4191.

**Is there a fix for CVE-2026-9770?** A patch was published on 2026-05-20: Firmware build date for the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9770 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-9770?** Check whether you run TP-Link Kasa EC70 or TP-Link Kasa EC71 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the firmware of TP-Link Kasa EC70 v4 and EC71 v4 cameras due to the use of a hard-coded cryptographic key (CWE-321). The static private key is stored within a read-only filesystem and is shared across all devices of these models. An attacker can extract this key from the publicly available firmware image. With the key, an unauthenticated attacker positioned on the same local network (adjacent) can decrypt encrypted traffic to the web management service or execute man-in-the-middle (MITM) attacks. The issue is addressed in firmware version 2.4.0 Build 20260520 rel.4191 and later.

## Affected products

- TP-Link Kasa EC70 v4 Before 2.4.0 Build 20260520 rel.4191
- TP-Link Kasa EC71 v4 Before 2.4.0 Build 20260520 rel.4191

## Timeline

- 2026-05-20: patched: Firmware build date for the fix
- 2026-07-14: advisory
- 2026-07-15: disclosed

## References

- [https://www.tp-link.com/en/support/download/ec70/v4/](https://www.tp-link.com/en/support/download/ec70/v4/)
- [https://www.tp-link.com/en/support/download/ec71/v4/](https://www.tp-link.com/en/support/download/ec71/v4/)
- [https://www.tp-link.com/us/support/download/ec70/v4/](https://www.tp-link.com/us/support/download/ec70/v4/)
- [https://www.tp-link.com/us/support/download/ec71/v4/](https://www.tp-link.com/us/support/download/ec71/v4/)
- [https://www.tp-link.com/us/support/faq/5192/](https://www.tp-link.com/us/support/faq/5192/)

## Related threats

- [TP-Link Kasa EC70 and EC71 v4 debug interface and bootloader bypass](https://junglewise.ai/threats/cve-2026-102370-kasa-ec70-v4-and-ec71-v4-do-not-logically-disable-the-production)
- [TP-Link Kasa EC70 and EC71 information disclosure in local discovery](https://junglewise.ai/threats/cve-2026-13230-tp-link-kasa-ec70-and-ec71-information-disclosure-in-local)