CVE-2026-13230mediumCWE-200

CVE-2026-13230: medium-severity vulnerability in TP-Link Systems Inc. Kasa EC70 v4

Information Disclosure Vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC71

Published

Follow this CVE+ Monitor Kasa EC70+ Monitor Kasa EC71

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related data through crafted responses. The vulnerability impacts confidentiality only, with no evidence of integrity of availability impact.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
TP-Link Systems Inc. · Kasa EC70 v4TP-Link Systems Inc. · Kasa EC71 v4
Related CVEs — TP-Link Systems Inc. Kasa EC70 v4

In the same product, most dangerous first.

CVE-2026-9770HIGHHardcoded Cryptographic Key Information Disclosure Vulnerability on TP-Link Kasa EC70 and EC71EPSS 0.3%