Which versions of Kasa Camera are affected by CVE-2026-9770?

TP-Link Kasa EC71 v4 and EC70 v4 camera firmware contains a hard-coded cryptographic key shared across all device units, enabling adjacent-network attackers to decrypt surveillance traffic and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-9770?

Yes, a public proof-of-concept exploit is available for CVE-2026-9770. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-9770?

Within 24 hours, identify and inventory all deployed TP-Link Kasa EC71 v4 and EC70 v4 cameras and confirm their network accessibility and connectivity status. Within 7 days, apply the vendor-released firmware patch to all affected devices by checking the TP-Link Kasa mobile application or vendor support channels for the latest firmware version, coordinating updates during maintenance windows to minimize operational impact. Within 30 days, conduct a post-patch verification to confirm all cameras are running the latest patched firmware version, and implement network segmentation (VLAN isolation, access-control lists) to restrict camera management access to authorized administrator networks only.

Kasa Camera CVE-2026-9770

Q: What is the CVSS score of CVE-2026-9770?

CVE-2026-9770 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-44576 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2026-07-15 TPLink

GHSA-q3g3-7q7p-5jwv

Information Disclosure Kasa Ec71 V4 Kasa Ec70 V4 Tp Link Systems Inc

8.6

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

8.6 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Adjacent-network only (AV:A) with no auth or interaction; shared key enables both traffic decryption (C:H) and active MITM tampering (I:H), no availability impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 01:15 vuln.today

CVE Published

Jul 15, 2026 - 00:21 cve.org

HIGH 8.6

DescriptionCVE.org

Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access to the firmware image can extract the embedded key.

Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encrypted communications. This may enable passive decryption of traffic or active man-in-the-middle (MITM) attacks

AnalysisAI

Use of a hard-coded, device-shared cryptographic private key in TP-Link Kasa EC71 v4 and EC70 v4 camera firmware lets an adjacent-network attacker impersonate the device's web management service and break its transport encryption. Because the same private key is baked into every unit's read-only filesystem, anyone who extracts it from one firmware image can passively decrypt or actively man-in-the-middle traffic to any other device on the local network without authentication. TP-Link (the reporting vendor) has released fixed firmware; there is no public exploit identified at time of analysis and the CVE is not in CISA KEV.

Technical ContextAI

The affected products are TP-Link Kasa EC71 v4 and EC70 v4 smart cameras (per CPE cpe:2.3:a:tp-link_systems_inc.:kasa_ec71_v4 and kasa_ec70_v4). The root cause is CWE-321, Use of Hard-coded Cryptographic Key: a single static private key is embedded in the read-only filesystem of the firmware image and reused across the entire product line rather than being generated per-device at first boot. That key underpins the TLS/encrypted channel of the on-device web management service, so its secrecy is the sole basis for authenticating the server and protecting session confidentiality. Once the shared key is known, the cryptographic guarantee of that channel collapses for every device using the same firmware.

RemediationAI

Patch available per vendor advisory: apply the corrected TP-Link firmware for the EC71 v4 and EC70 v4 from the official release notes (https://www.tp-link.com/us/support/download/ec71/v4/#Firmware-Release-Notes and https://www.tp-link.com/us/support/download/ec70/v4/#Firmware-Release-Notes; guidance at https://www.tp-link.com/us/support/faq/5192/) - the exact fixed build number is not stated in the input data and should be confirmed against those release notes before deployment. Because the private key is shared across devices, a proper fix must rotate to a per-device key, so verify the update actually re-provisions device keys rather than merely repackaging. Until every affected camera is updated, isolate the cameras on a dedicated VLAN or segmented IoT SSID to remove untrusted hosts from the adjacent network (trade-off: legitimate LAN apps must be granted explicit access), and restrict access to the device's web management service to trusted management hosts only (trade-off: local browser administration becomes harder). Avoid running these cameras on shared/guest Wi-Fi where an attacker could sit on the same segment.