TI-2026-11234 Aliases CVE-2026-13230 GHSA-rccw-h6pm-46g4

Information Disclosure Vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC71

LOW 24CWE-200Published 2026-07-15 · Updated 2026-07-15

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related data through crafted responses. The vulnerability impacts confidentiality only, with no evidence of integrity of availability impact.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00396 34th percentileScored 2026-11-07

Fix Fixed Kasa EC71 v4 (TP-Link Systems Inc.): 2.4.1 Build 20260621 rel.76536Kasa EC70 v4 (TP-Link Systems Inc.): 2.4.1 Build 20260621 rel.76536

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TP-Link	Kasa EC71 v4	before 2.4.1 Build 20260621 rel.76536	2.4.1 Build 20260621 rel.76536	Patch available	CNA
TP-Link	Kasa EC70 v4	before 2.4.1 Build 20260621 rel.76536	2.4.1 Build 20260621 rel.76536	Patch available	CNA

Kasa EC71 v4 VendorTP-Link Affected before 2.4.1 Build 20260621 rel.76536 Fixed in 2.4.1 Build 20260621 rel.76536 Patch available CNA
Kasa EC70 v4 VendorTP-Link Affected before 2.4.1 Build 20260621 rel.76536 Fixed in 2.4.1 Build 20260621 rel.76536 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:o:tp-link:kasa_ec70_firmware::::::::	before 2.4.1	Vulnerable	TP-Link
cpe:2.3:h:tp-link:kasa_ec70:4.0:::::::*	4.0	Running on	TP-Link
cpe:2.3:o:tp-link:kasa_ec71_firmware::::::::	before 2.4.1	Vulnerable	TP-Link
cpe:2.3:h:tp-link:kasa_ec71:4.0:::::::*	4.0	Running on	TP-Link

cpe:2.3:o:tp-link:kasa_ec70_firmware:*:*:*:*:*:*:*:* Versions before 2.4.1 Vulnerable ·TP-Link
cpe:2.3:h:tp-link:kasa_ec70:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·TP-Link
cpe:2.3:o:tp-link:kasa_ec71_firmware:*:*:*:*:*:*:*:* Versions before 2.4.1 Vulnerable ·TP-Link
cpe:2.3:h:tp-link:kasa_ec71:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·TP-Link

Remediation

Fix · CNA Kasa EC71 v4 (TP-Link Systems Inc.) Fixed in 2.4.1 Build 20260621 rel.76536
Fix · CNA Kasa EC70 v4 (TP-Link Systems Inc.) Fixed in 2.4.1 Build 20260621 rel.76536

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-07-15
TP-Link Systems Kasa EC70 v4, Kasa EC71 v4 — tp-link.com/us/support/faq/5192
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-08561 Hardcoded Cryptographic Key Information Disclosure Vulnerability on TP-Link Kasa EC70 and EC71Priority LOW 39
Show all 2 records → Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-13230
2026-10-03 Alias added: GHSA-rccw-h6pm-46g4

References

Patch 4

Advisory 1

https://www.tp-link.com/us/support/faq/5192/

TI-2026-08561 Hardcoded Cryptographic Key Information Disclosure Vulnerability on TP-Link Kasa EC70 and EC71 CVSS 4.0HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences