PT-2026-58866 · Tp Link Systems · Kasa Ec70 V4+1

Christopher Childress · Published 2026-07-15 · Updated 2026-07-15 · CVE-2026-13230

NVD

CVSS v4.0

5.3

Medium

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related data through crafted responses.

The vulnerability impacts confidentiality only, with no evidence of integrity of availability impact.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-13230

Affected Products

Kasa Ec70 V4

Kasa Ec71 V4

References · 6

• https://tp-link.com/en/support/download/ec70/v4/#Firmware-Release-Notes · Patch
• https://tp-link.com/us/support/download/ec71/#Firmware-Release-Notes · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-13230 · Security Note
• https://tp-link.com/us/support/download/ec70/v4/#Firmware-Release-Notes · Patch
• https://tp-link.com/us/support/faq/5192 · Vendor Advisory
• https://tp-link.com/en/support/download/ec71/#Firmware-Release-Notes · Patch