Vulnerability Description
An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related data through crafted responses. The vulnerability impacts confidentiality only, with no evidence of integrity of availability impact.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tp-Link | Kasa Ec70 Firmware | < 2.4.1 |
| Tp-Link | Kasa Ec70 | 4.0 |
| Tp-Link | Kasa Ec71 Firmware | < 2.4.1 |
| Tp-Link | Kasa Ec71 | 4.0 |
Related Weaknesses (CWE)
References
- https://www.tp-link.com/en/support/download/ec70/v4/#Firmware-Release-NotesRelease Notes
- https://www.tp-link.com/en/support/download/ec71/#Firmware-Release-NotesRelease Notes
- https://www.tp-link.com/us/support/download/ec70/v4/#Firmware-Release-NotesRelease Notes
- https://www.tp-link.com/us/support/download/ec71/#Firmware-Release-NotesRelease Notes
- https://www.tp-link.com/us/support/faq/5192/Vendor Advisory
FAQ
What is CVE-2026-13230?
CVE-2026-13230 is a vulnerability with a CVSS score of 6.5 (MEDIUM). An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentic...
How severe is CVE-2026-13230?
CVE-2026-13230 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-13230?
Check the references section above for vendor advisories and patch information. Affected products include: Tp-Link Kasa Ec70 Firmware, Tp-Link Kasa Ec70, Tp-Link Kasa Ec71 Firmware, Tp-Link Kasa Ec71.