Read the docs
TI-2026-08561 Aliases CVE-2026-9770GHSA-q3g3-7q7p-5jwv

Hardcoded Cryptographic Key Information Disclosure Vulnerability on TP-Link Kasa EC70 and EC71

Priority LOW 39CWE-321Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.

Summary

Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices.  An attacker with access to the firmware image can extract the embedded key.  Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encrypted communications. This may enable passive decryption of traffic or active man-in-the-middle (MITM) attacks

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix Fixed Kasa EC71 v4 (TP-Link Systems Inc.): 2.4.0 Build 20260520 rel.4191Kasa EC70 v4 (TP-Link Systems Inc.): 2.4.0 Build 20260520 rel.4191

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkKasa EC71 v4before 2.4.0 Build 20260520 rel.41912.4.0 Build 20260520 rel.4191Patch availableCNA
TP-LinkKasa EC70 v4before 2.4.0 Build 20260520 rel.41912.4.0 Build 20260520 rel.4191Patch availableCNA
  • Kasa EC71 v4 VendorTP-Link Affected before 2.4.0 Build 20260520 rel.4191 Fixed in 2.4.0 Build 20260520 rel.4191 Patch available CNA
  • Kasa EC70 v4 VendorTP-Link Affected before 2.4.0 Build 20260520 rel.4191 Fixed in 2.4.0 Build 20260520 rel.4191 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:kasa_ec71_firmware:*:*:*:*:*:*:*:*before 2.4.0VulnerableTP-Link
cpe:2.3:h:tp-link:kasa_ec71:4.0:*:*:*:*:*:*:*4.0Running onTP-Link
cpe:2.3:o:tp-link:kasa_ec70_firmware:*:*:*:*:*:*:*:*before 2.4.0VulnerableTP-Link
cpe:2.3:h:tp-link:kasa_ec70:4.0:*:*:*:*:*:*:*4.0Running onTP-Link
  • cpe:2.3:o:tp-link:kasa_ec71_firmware:*:*:*:*:*:*:*:* Versions before 2.4.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:kasa_ec71:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:kasa_ec70_firmware:*:*:*:*:*:*:*:* Versions before 2.4.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:kasa_ec70:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·TP-Link

Remediation

  • Fix · CNA Kasa EC71 v4 (TP-Link Systems Inc.) Fixed in 2.4.0 Build 20260520 rel.4191
  • Fix · CNA Kasa EC70 v4 (TP-Link Systems Inc.) Fixed in 2.4.0 Build 20260520 rel.4191

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TP-Link Systems Kasa EC70 v4, Kasa EC71 v4 — tp-link.com/us/support/faq/5192

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-11234 Information Disclosure Vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC71Priority LOW 24
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9770
  2. 2026-10-03 Alias added: GHSA-q3g3-7q7p-5jwv

References

Patch 4

Advisory 1

  • TI-2026-11234 Information Disclosure Vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC71 CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences