CVE-2026-9770: Kasa Camera Information Disclosure Flaw

CVE-2026-9770 Overview

CVE-2026-9770 affects TP-Link Kasa EC71 v4 and EC70 v4 devices. The firmware embeds a static cryptographic private key inside a read-only filesystem. Every device of these models ships with the same key. An attacker who obtains the firmware image can extract this key and reuse it against any deployed unit.

The issue is classified as Use of Hard-coded Cryptographic Key [CWE-321]. Successful exploitation lets an unauthenticated attacker on the adjacent network target the web management service. Traffic that relies on the shared key can be passively decrypted or actively manipulated through man-in-the-middle (MITM) attacks.

Critical Impact
A shared, hardcoded private key allows adjacent-network attackers to decrypt management traffic or hijack sessions on any Kasa EC70 v4 and EC71 v4 device.

Affected Products

TP-Link Kasa EC71 v4 (firmware versions prior to the vendor's fixed release)
TP-Link Kasa EC70 v4 (firmware versions prior to the vendor's fixed release)
Devices sharing the same firmware image and embedded key material

Discovery Timeline

2026-07-15 - CVE-2026-9770 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-9770

Vulnerability Analysis

The Kasa EC70 v4 and EC71 v4 firmware images contain a private key stored on a read-only partition. Because the key is baked into the image, every device produced from that firmware build uses the same secret. This eliminates the per-device uniqueness that Transport Layer Security (TLS) and similar protocols depend on.

An attacker who downloads the firmware from the vendor site, extracts a physical flash chip, or acquires a used device can recover the key with standard binary analysis tools. Once extracted, the same key applies to every deployed unit worldwide.

The attack requires adjacent network access, meaning the attacker must be on the same Layer 2 network segment as the target. This includes shared Wi-Fi, LANs, and compromised routers in the traffic path.

Root Cause

The root cause is the use of a hardcoded cryptographic key [CWE-321] shipped inside the firmware image. Secure design requires unique per-device key material generated at first boot or provisioned during manufacturing, then stored in write-protected secure storage. Embedding a shared key in a read-only filesystem exposes the secret to anyone with access to the image.

Attack Vector

Exploitation proceeds in two phases. First, the attacker extracts the private key from the firmware image using tools such as binwalk, dd, and standard filesystem extractors, then locates the key file within the extracted rootfs. Second, the attacker positions themselves on the same network as a target device and uses the key against the web management service. This enables decryption of captured session traffic or interception of new sessions through Address Resolution Protocol (ARP) spoofing or rogue access points. No exploitation code is required beyond common network interception tooling.

Detection Methods for CVE-2026-9770

Indicators of Compromise

Unexpected ARP table changes on network segments containing Kasa EC70 v4 or EC71 v4 devices
Duplicate MAC address alerts or gratuitous ARP traffic near affected devices
Unauthorized management sessions to the device web interface from unfamiliar internal hosts
Unusual outbound traffic patterns from the device that suggest configuration tampering

Detection Strategies

Inspect network traffic for TLS sessions that terminate at hosts other than the legitimate device gateway
Compare running device firmware version against the vendor's fixed release listed in the TP-Link release notes
Baseline management-plane traffic and alert on new source addresses interacting with the web management service

Monitoring Recommendations

Deploy network detection and response tooling on segments hosting IoT devices to flag ARP spoofing and MITM patterns
Log all administrative logins to the Kasa management interface and forward events to a central SIEM
Monitor vendor advisories at the TP-Link EC70 Firmware Release Notes and TP-Link EC71 Firmware Release Notes for updated fixed versions

How to Mitigate CVE-2026-9770

Immediate Actions Required

Inventory all Kasa EC70 v4 and EC71 v4 devices across the environment and identify firmware versions in use
Apply the vendor firmware update as soon as TP-Link publishes a fixed release for the affected models
Isolate affected devices on a dedicated VLAN with restricted access to the management interface
Rotate any credentials or shared secrets configured on the device after patching

Patch Information

TP-Link publishes firmware for these models on the product support pages. Refer to the TP-Link EC70 US Firmware Release Notes and TP-Link EC71 US Firmware Release Notes for the version that remediates the hardcoded key issue. Additional guidance is available in the TP-Link FAQ on Security.

Workarounds

Restrict access to the device web management service using firewall rules that permit only trusted administrative hosts
Disable remote management features and require administration only from a wired, trusted subnet
Enforce 802.1X or MAC filtering on wireless networks that host these devices to limit adjacent-network exposure
Use a jump host or bastion for management traffic to minimize opportunities for on-path attackers

bash

# Example firewall rule restricting management access to an admin subnet
iptables -A FORWARD -p tcp -d <device-ip> --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <device-ip> --dport 443 -j DROP