TP Link Systems Inc. Kasa EC71 V4 vulnerabilities

3 vulnerabilities

Known vulnerabilities in TP Link Systems Inc. Kasa EC71 V4, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.5MediumCVE-2026-13230tp-link systems inc. · kasa ec70 v4 +3 moreInformation Disclosure Vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC71An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related data through crafted responses. The vulnerability impacts confidentiality only, with no evidence of integrity of availability impact.EPSS0.40%5.4MediumCVE-2026-102370tp-link systems inc. · kasa ec70 v4 +1 morePhysical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC71Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader.  Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot process, and manipulate boot parameters to enter a non-standard initialization path that exposes an unauthenticated root shell during startup. Successful exploitation may allow an attacker with physical access to obtain root-level command access during device startup, resulting in loss of confidentiality, integrity, and availability for the affected device. Exploitation requires device disassembly, restoration of the severed debug connection, and manipulation of the boot process.EPSS0.18%8.6HighCVE-2026-9770tp-link systems inc. · kasa ec70 v4 +3 moreHardcoded Cryptographic Key Information Disclosure Vulnerability on TP-Link Kasa EC70 and EC71Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices.  An attacker with access to the firmware image can extract the embedded key.  Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encrypted communications. This may enable passive decryption of traffic or active man-in-the-middle (MITM) attacksEPSS0.31%