CVE-2026-13230: TP-Link Kasa Camera Info Disclosure Flaw

CVE-2026-13230 Overview

CVE-2026-13230 is an information disclosure vulnerability affecting TP-Link Kasa EC70 v4 and EC71 v4 smart cameras. The flaw resides in the local network discovery mechanism, which returns sensitive geolocation data in response to unauthenticated requests. Any attacker positioned on the same local network segment can query the device and receive geolocation-related information without providing credentials. The weakness is categorized as an exposure of sensitive information to an unauthorized actor [CWE-200]. Confidentiality is the only security property affected, with no reported impact to integrity or availability of the device.

Critical Impact
An unauthenticated adjacent attacker can retrieve geolocation data from affected TP-Link Kasa cameras by sending crafted discovery responses on the local network.

Affected Products

TP-Link Kasa EC70 v4
TP-Link Kasa EC71 v4
Firmware versions prior to the fixed release listed in the TP-Link EC70/EC71 firmware release notes

Discovery Timeline

2026-07-15 - CVE-2026-13230 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-13230

Vulnerability Analysis

The vulnerability exists in the local discovery service exposed by the TP-Link Kasa EC70 v4 and EC71 v4 cameras. Smart home devices typically broadcast discovery packets so companion mobile applications can enumerate them on the local Wi-Fi network. In these camera models, the discovery handler returns geolocation-related metadata as part of its response payload. The handler does not require the requester to authenticate, so any host on the same broadcast domain can solicit and receive this data.

The attack requires network adjacency, meaning the attacker must be connected to the same local network as the camera. This can be a shared home Wi-Fi network, a guest network that is bridged to the main segment, or a corporate LAN where the camera is deployed. No user interaction is required, and no privileges on the target device are needed. The current EPSS probability of exploitation is 0.246%.

Root Cause

The root cause is a design flaw in the local discovery protocol implementation. Sensitive geolocation fields are included in unauthenticated responses that were intended only for benign device enumeration. The device does not enforce an authentication or authorization check before disclosing this metadata, violating the principle of least information exposure described in [CWE-200].

Attack Vector

An attacker on the adjacent network sends a crafted request to the device's discovery service. The camera replies with a discovery payload containing geolocation-related fields. The attacker parses this data offline and can associate the device, and by extension the owner, with a physical location. Because the vulnerability affects confidentiality only, the attacker cannot alter camera configuration, tamper with video, or disrupt service by exploiting this issue alone. A working proof of concept is not publicly available at the time of writing.

For implementation details, refer to the TP-Link EC70 Firmware Release Notes and the TP-Link EC71 Firmware Release Notes.

Detection Methods for CVE-2026-13230

Indicators of Compromise

Unexpected unicast or broadcast probes targeting TP-Link Kasa discovery ports originating from hosts other than the Kasa mobile application
Discovery response packets from EC70 v4 or EC71 v4 cameras containing geolocation fields sent to unfamiliar LAN endpoints
Repeated scan patterns from a single LAN host enumerating multiple IoT devices in a short time window

Detection Strategies

Baseline normal Kasa discovery traffic and alert on discovery requests originating from workstations, servers, or unknown devices rather than the paired mobile app
Inspect wireless client lists for unauthorized or unrecognized devices that could act as adjacent attackers
Use passive network monitoring on the LAN or VLAN hosting IoT devices to capture discovery exchanges and flag anomalies

Monitoring Recommendations

Enable logging on the network router or access point to record new device associations and unusual broadcast traffic
Forward LAN telemetry to a centralized SIEM or data lake for correlation with other IoT device behavior
Periodically review firmware versions on all TP-Link Kasa cameras and confirm they match the current vendor release

How to Mitigate CVE-2026-13230

Immediate Actions Required

Update TP-Link Kasa EC70 v4 and EC71 v4 devices to the latest firmware published by TP-Link for each model
Segment IoT devices onto a dedicated VLAN or isolated Wi-Fi SSID that untrusted clients cannot reach
Audit which devices are connected to the network segment hosting the cameras and remove any unauthorized clients

Patch Information

TP-Link has published firmware updates addressing this issue. Refer to the TP-Link EC70 v4 Firmware Release Notes, the TP-Link EC71 Firmware Release Notes, and the TP-Link Security FAQ for version details and installation guidance. Apply updates through the Kasa mobile application or the device web interface.

Workarounds

Place the cameras on an isolated network segment with client isolation enabled to block peer-to-peer discovery from other LAN hosts
Restrict Wi-Fi access using WPA2 or WPA3 with strong credentials and disable guest network bridging to the primary LAN
Disable the local discovery feature if the vendor exposes a configuration option, or block the discovery port at the router for untrusted clients

bash

# Configuration example: isolate IoT VLAN on a Linux-based router (iptables)
# Assume IoT VLAN is on interface iot0 and trusted LAN is on lan0
iptables -A FORWARD -i lan0 -o iot0 -m state --state NEW -j ACCEPT
iptables -A FORWARD -i iot0 -o lan0 -m state --state NEW -j DROP
iptables -A FORWARD -i iot0 -o iot0 -j DROP