TP-Link Kasa CVE-2026-13230

The attacker must be on the same local network segment (adjacent network) as the affected TP-Link Kasa EC70 v4 or EC71 v4 device - for example, connected to the same Wi-Fi access point or LAN. No authentication is required (PR:N per CVSS). The device must be powered on and operational so its local discovery service is responsive. No special non-default configuration is required; the vulnerability exists in the default discovery mechanism. Exploitation is limited by the adjacency requirement: remote internet-based attackers cannot reach the discovery service without first gaining LAN access via another vector (e.g., VPN compromise, rogue device, or physical access). Geolocation data exposure is the only impact; the attacker cannot modify device settings or cause a denial of service through this vector.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) accurately captures the constrained risk profile. The adjacent network requirement (AV:A) is the primary limiting factor: exploitation requires physical or logical presence on the same network segment as the device, ruling out internet-scale opportunistic attacks. The low confidentiality impact (VC:L) reflects geolocation data leakage - sensitive from a privacy standpoint but not a system-compromise class finding. No KEV listing and no public POC have been identified, and EPSS data is not available for this CVE. The vulnerability is real and warrants patching - particularly in enterprise or sensitive-location deployments where physical location disclosure is a meaningful operational security concern - but it does not represent an imminent compromise risk for most consumer deployments. The risk is elevated in environments where insider threat or rogue Wi-Fi client access is a concern.

An attacker connected to the same Wi-Fi or wired LAN segment as a Kasa EC70 or EC71 device crafts a discovery protocol request targeting the device's local advertisement service. The device responds with a payload that includes geolocation metadata - such as coordinates or address data stored by the device - without requiring any credentials. No public exploit code exists, but the attack requires only basic network tooling and knowledge of the discovery protocol format.