Home cameras rarely stray beyond the local network. Nevertheless, vulnerabilities in the TP-Link Kasa EC70 and EC71 allow an attacker already inside that network to intercept administrator credentials and glean the device's location. CVE-2026-9770: A Hardcoded Key Opens the Door The most dangerous vulnerability, CVE-2026-9770, earned a score of 8.6 on the CVSS 4.0 scale. A hardcoded cryptographic key resides within the cameras' firmware.

TL;DR TP-Link has patched two information disclosure flaws in Kasa EC70 v4 and EC71 v4 cameras. The more severe TP-Link Kasa vulnerability, CVE-2026-9770 (CVSS 8.6), stems from a hardcoded cryptographic key that enables credential interception. A second flaw, CVE-2026-13230 (CVSS 5.3), leaks geolocation data without authentication. TP-Link reports no in-the-wild exploitation, and no public proof-of-concept exists. Why It Matters Kasa cameras sit inside homes and small offices, watching private spaces.