CVE-2026-13230
Medium
Description
An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related data through crafted responses. The vulnerability impacts confidentiality only, with no evidence of integrity of availability impact.
SeverityMedium
CVSS6.5
Exploit probability34. percentile0.4%
Product
Tp-link Kasa Ec70 Firmware
PublishedJul 15, 2026
First seenJul 15, 2026
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- tp-link kasa_ec70_firmware2.4.1 or later
- tp-link kasa_ec71_firmware2.4.1 or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tp-link kasa_ec70_firmware | v < 2.4.1 | 2.4.1 |
| tp-link kasa_ec71_firmware | v < 2.4.1 | 2.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.