Log in Start free

Vulnerability · Published Jul 15, 2026 · Assigned by TPLink

CVE-2026-13230Information Disclosure Vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC71

Medium 5.3

In plain English

A medium-severity information exposure in Kasa EC70 v4 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.4%top 66.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related data through crafted responses. The vulnerability impacts confidentiality only, with no evidence of integrity of availability impact.

Affected products (as reported)

VendorProductVersions
TP-Link Systems Inc. Kasa EC71 v4 0 – before 2.4.1 Build 20260621 rel.76536
TP-Link Systems Inc. Kasa EC70 v4 0 – before 2.4.1 Build 20260621 rel.76536

Weakness: CWE-200 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References