EUVD-2026-44577
GHSA-rccw-h6pm-46g4
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent network vector required; no authentication needed; only low confidentiality impact from geolocation disclosure; no integrity or availability impact.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
Lifecycle Timeline
1DescriptionCVE.org
An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related data through crafted responses.
The vulnerability impacts confidentiality only, with no evidence of integrity of availability impact.
AnalysisAI
Unauthenticated information disclosure in TP-Link Kasa EC70 v4 and EC71 v4 exposes sensitive geolocation data to any attacker on the same local network segment. The flaw resides in the devices' local discovery mechanism, which returns geolocation-related information in response to crafted network probes without requiring any credentials. Impact is limited to confidentiality; no integrity or availability compromise is possible through this vector. No public exploit exists and no active exploitation has been confirmed.
Technical ContextAI
The affected products are TP-Link Kasa-branded smart devices (CPE: cpe:2.3:a:tp-link_systems_inc.:kasa_ec71_v4 and cpe:2.3:a:tp-link_systems_inc.:kasa_ec70_v4), likely smart cameras or plugs with built-in local network discovery protocols (e.g., mDNS, SSDP, or a proprietary TP-Link discovery protocol). CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause: the discovery mechanism broadcasts or responds to probes with more information than is necessary, including geolocation metadata that should be restricted. This is a classic over-disclosure in IoT device advertisement protocols, where convenience features expose device context data without access controls.
RemediationAI
The primary remediation is applying the patched firmware provided by TP-Link. Firmware release notes and downloads are available at https://www.tp-link.com/us/support/download/ec71/#Firmware-Release-Notes and https://www.tp-link.com/us/support/download/ec70/v4/#Firmware-Release-Notes; users should update to the latest firmware version listed on those pages. The vendor advisory at https://www.tp-link.com/us/support/faq/5192/ should be consulted for the specific fixed firmware version. As a compensating control prior to patching, isolating these devices on a dedicated IoT VLAN with strict inter-VLAN routing rules will prevent untrusted local network clients from reaching the discovery port - this is architecturally sound regardless of patching. Disabling device discovery features via the Kasa app (if the option exists) may also reduce exposure but should be verified not to break core device functionality.
More in Kasa Ec71 V4
View allSame weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today