An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local…

CVE-2026-13230 affects TP-Link Kasa EC70 v4 and EC71 v4 consumer smart cameras running firmware prior to 2.4.1 Build 20260621. The local discovery service on UDP port 9999 responds to unauthenticated get_sysinfo requests with a JSON payload containing precise sub-meter GPS coordinates, hardware identifiers (oemId, hwId, deviceId, MAC addresses), the user-assigned device alias, and the full firmware version string. The payload is "encrypted" with a trivial XOR cipher that Wireshark decodes natively. Any device on the same Layer 2 network can query the camera with a single UDP packet — no credentials, no session, no complexity.

The vendor scored this 5.3 (Medium) under CVSS 4.0, while the discovering researcher (Christopher Childress / BadChemical) argued for 7.1. For an enterprise managing 10,000 hosts, the vendor score is actually *generous*. These are consumer-grade IoT cameras unlikely to appear in production infrastructure at meaningful scale. The attack vector is adjacent-network only (AV:A), meaning the attacker must already be on the same LAN. The impact is pure information disclosure — no code execution, no integrity compromise, no availability impact. The leaked data (GPS coordinates, hardware IDs) is a privacy concern but does not enable lateral movement, privilege escalation, or data exfiltration from enterprise systems. This is backlog-tier work for most shops.

Why this verdict

• Adjacent-network-only attack vector (AV:A): The attacker must already be on the same Layer 2 segment as the camera. In any enterprise with basic network segmentation, IoT devices sit on isolated VLANs unreachable from user workstations or the internet. This alone narrows the reachable attacker population dramatically.
• Consumer IoT with negligible enterprise footprint: Kasa EC70/EC71 are consumer smart home cameras sold through Amazon and retail channels. Enterprise physical security deployments use Axis, Verkada, Hanwha, Milestone — not TP-Link Kasa. Fewer than 0.1% of enterprises managing 10,000+ hosts have these in their asset inventory.
• Information disclosure only — no execution, no escalation: The leaked data is GPS coordinates and hardware IDs. While this is a privacy concern, it does not provide credentials, shell access, or any pivot into enterprise systems. The GPS coordinates of a known office building are typically already public via Google Maps.
• Role multiplier: Not applicable. Kasa cameras do not occupy any high-value enterprise role (not a DC, hypervisor, IdP, PAM, CI/CD, backup server, network edge appliance, or security agent). They are peripheral IoT devices. Even if compromised, the blast radius is limited to the individual device — no domain, fleet, or supply-chain impact. The high-value role floor does not apply.

Why not higher?

Upgrading to MEDIUM or higher would require either a broader attack vector (network/internet-routable), a higher-value target class (enterprise infrastructure), or a more impactful outcome (code execution, credential theft enabling lateral movement). None of these conditions are met. The companion CVE-2026-9770 (hardcoded RSA keys, credential exposure) is the more serious finding in this pair and warrants separate assessment — this CVE standing alone leaks only location metadata.

Why not lower?

Dropping to IGNORE would understate the risk for the small number of organizations that *do* have these cameras on their networks. The PoC is public and trivial, the attack is zero-click with no authentication, and the leaked GPS data could enable physical security reconnaissance (identifying facility locations, camera placements) that feeds into physical intrusion planning. For organizations with these devices, a firmware update is warranted — just not urgently.

1. Isolate cameras on a dedicated IoT VLAN with no inter-host communication — Place all Kasa cameras on a VLAN where devices cannot communicate with each other or with user workstations. Block UDP port 9999 between hosts on the segment. This eliminates the adjacent-network attack path entirely. No SLA pressure — LOW verdict means treat as backlog hygiene.
2. Apply firmware 2.4.1 during next maintenance window — Update EC70 v4 and EC71 v4 cameras to firmware 2.4.1 Build 20260621, which removes GPS data from the get_sysinfo response and disables unauthenticated port 9999 queries. Coordinate with facilities/physical security team. No mitigation SLA applies for LOW severity.
3. Inventory and consider replacing consumer cameras with enterprise-grade alternatives — If these cameras serve any physical security function, evaluate migration to enterprise surveillance platforms (Axis, Verkada, Milestone) that offer centralized management, encrypted communications, and proper authentication. This addresses the broader pattern — CVE-2026-9770 in the same product line is more severe.

Run this script from any host on the same network segment as the target camera. Invoke with: python3 check_cve_2026_13230.py <camera_ip>. Requires no special privileges — just UDP socket access and Layer 2 adjacency to the camera.

#!/usr/bin/env python3
"""Check for CVE-2026-13230: TP-Link Kasa EC70/EC71 unauthenticated GPS disclosure.
Usage: python3 check_cve_2026_13230.py <camera_ip>
Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
"""
import sys
import socket
import json
import struct

def encrypt(plaintext):
    key = 171
    result = struct.pack('>I', len(plaintext))
    for c in plaintext:
        a = key ^ ord(c)
        key = a
        result += bytes([a])
    return result

def decrypt(ciphertext):
    key = 171
    result = ""
    for b in ciphertext:
        a = key ^ b
        key = b
        result += chr(a)
    return result

def main():
    if len(sys.argv) != 2:
        print("Usage: python3 check_cve_2026_13230.py <camera_ip>")
        sys.exit(2)
    target = sys.argv[1]
    port = 9999
    payload = '{"system":{"get_sysinfo":{}}}'
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((target, port))
        sock.sendall(encrypt(payload))
        response = b""
        while True:
            chunk = sock.recv(4096)
            if not chunk:
                break
            response += chunk
        sock.close()
        if len(response) <= 4:
            print("UNKNOWN - No meaningful response from device.")
            sys.exit(2)
        decrypted = decrypt(response[4:])
        try:
            data = json.loads(decrypted)
            sysinfo = data.get("system", {}).get("get_sysinfo", {})
            has_gps = False
            for key in sysinfo:
                if "latitude" in key.lower() or "longitude" in key.lower() or "gps" in key.lower():
                    has_gps = True
                    break
            if has_gps:
                print("VULNERABLE - Device responded with GPS/location data via unauthenticated query.")
                print("  Firmware: " + sysinfo.get("sw_ver", "unknown"))
                sys.exit(1)
            else:
                print("PATCHED - Device responded but no GPS/location fields present in sysinfo.")
                print("  Firmware: " + sysinfo.get("sw_ver", "unknown"))
                sys.exit(0)
        except json.JSONDecodeError:
            print("UNKNOWN - Response received but could not parse JSON.")
            sys.exit(2)
    except socket.timeout:
        print("UNKNOWN - Connection timed out. Device may be patched (port 9999 no longer responds) or unreachable.")
        sys.exit(2)
    except ConnectionRefusedError:
        print("PATCHED - Port 9999 refused connection. Firmware 2.4.1+ disables unauthenticated access.")
        sys.exit(0)
    except Exception as e:
        print(f"UNKNOWN - Error: {e}")
        sys.exit(2)

if __name__ == "__main__":
    main()

Sources

1. TP-Link Security Advisory (CVE-2026-9770 & CVE-2026-13230)
2. BadChemical IoT Vulnerability Research — Kasa EC71 Full Writeup
3. CyberSecurity News — TP-Link Cameras MitM Attacks
4. GBHackers — TP-Link Kasa Camera Credential and Geolocation Flaws
5. CyberPress — TP-Link Kasa Camera Credential and Location Exposure
6. CVEmon — CVE-2026-13230 Overview
7. OffSeq Threat Radar — CVE-2026-13230