CVE-2026-9770Patch(tp-link / kasa_ec70)

LOWCVSS 5.3 · MEDIUM

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Patch tp-link kasa_ec70 systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access to the firmware image can extract the embedded key. Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encrypted communications. This may enable passive decryption of traffic or active man-in-the-middle (MITM) attacks

tp-link CVEs Back to dashboard

2.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.tp-link.com/us/support/faq/5192/

Other references

Weakness type (CWE)

CWE-321

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

kasa_ec70
kasa_ec70_firmware
kasa_ec71
kasa_ec71_firmware

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
7 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 4 signals
Technical details provided in 7 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-07-17); latest day: 2
7 total mentions across 3 days

Affected systems

Vendors

tp-link

Products

kasa_ec70kasa_ec70_firmwarekasa_ec71kasa_ec71_firmware

1 version affected across 4 products

Deep dive

Activity timeline7 mentions / 3d

Signal classification3 categories

Patch

457.1%

Disclosure

228.6%

General

114.3%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	2	Disclosure1General1
2026-07-17	3	Patch3
2026-07-20	2	Disclosure1Patch1

Full discourse7 posts

elhacker.NET@elhackernet89d
Patch
Vulnerabilidad en cámaras TP-Link permite ataques MitM TP-Link ha lanzado actualizaciones de seguridad para corregir dos vulnerabilidades en sus cámaras inteligentes Kasa EC70 v4 y EC71 v4 CVE-2026-9770 y CVE-2026-13230 https://blog.elhacker.net/2026/07/vulnerabilidad-en-camaras-tp-link.html
Post summary
The post announces that TP‑Link cameras exposed to CVE-2026-9770 and CVE-2026-13230 can suffer MitM attacks and that the vendor has already issued remediation updates.
014039114.5K
141.7K followersView on X
Хабр@habr_com87d
Disclosure
3/ Главная проблема — CVE-2026-9770, оценка 8,6 из 10. Криптографический ключ вшит прямо в прошивку и одинаков для всех камер. Он должен защищать связь между камерой и веб-интерфейсом, но раз ключ общий, эта защита не работает.
Post summary
CVE‑2026‑9770 is disclosed with an 8.6/10 score, highlighting reused cryptographic keys in camera firmware that break intended security, but no PoC, exploit, patch, or active exploitation is mentioned.
10010868
381.5K followersView on X
Daily CyberSecurity@Daily_CyberSec87d
Patch
A TP-Link Kasa vulnerability (CVE-2026-9770) lets local attackers steal admin credentials via a hardcoded key. Patch your EC70 and EC71 firmware now. #TPLink #Kasa #CVE20269770 #IoTSecurity #Cameras #ManInTheMiddle http://meterpreter.org/tp-link-kasa-vulnerability/
Post summary
The tweet warns of a local credential‑stealing flaw (CVE‑2026‑9770) in TP‑Link Kasa routers and urges users to update EC70/EC71 firmware, also linking to a potential PoC.
01001421
12.5K followersView on X
CVE@CVEnew92d
General
CVE-2026-9770 Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access t… https://www.cve.org/CVERecord?id=CVE-2026-9770
Post summary
The post reports that CVE‑2026‑9770 involves a static cryptographic key shared across Kasa EC71 and EC70 firmware, indicating a potential security weakness.
00020885
58.1K followersView on X
TECHEPAGES@techepages89d
Patch
📷 TP-Link patches two flaws in Kasa EC70/EC71 v4 smart cameras that could enable MitM attacks on local networks. 🔹 CVE-2026-9770 (CVSS 8.6): hardcoded crypto key exposes admin traffic 🔹 CVE-2026-13230 (CVSS 5.3): discovery service leaks geolocation data 🔹 Fixed in firmware 2.4.0/2.4.1 — update via Kasa app 🔹 Until patched, isolate cameras on a separate IoT network
Post summary
TP‑Link has released firmware updates that address CVE‑2026‑9770 and CVE‑2026‑13230, which involve a hard‑coded crypto key and a location‑leaking discovery service that could enable Man‑in‑the‑Middle attacks; users should update to firmware 2.4.0/2.4.1 or isolate the cameras.
00000108
24 followersView on X
Daily CyberSecurity@Daily_CyberSec90d
Patch
TP-Link Kasa vulnerability CVE-2026-9770 (CVSS 8.6) lets local attackers intercept admin credentials on EC70 and EC71 cameras. Update firmware now. #TPLink #Kasa #IoTSecurity #CVE20269770 #InfoDisclosure http://securityonline.info/tp-link-kasa-vulnerability/
Post summary
The post highlights a CVE‑2026‑9770 vulnerability in TP‑Link Kasa EC70/EC71 cameras that allows local attackers to intercept admin credentials and urges users to update firmware to mitigate the issue.
00000401
12.5K followersView on X
Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-9770 Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access t… https://www.cve.org/CVERecord?id=CVE-2026-9770 ----- Traducción: CVE-2026-9770 El … http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑9770, highlighting a shared static cryptographic key in Kasa firmware, but does not mention any PoC, exploit code, patch, or active exploitation.
0000047
92 followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	tp-link	kasa_ec70	4.0	-	-
OS	tp-link	kasa_ec70_firmware	-	-	-
HW	tp-link	kasa_ec71	4.0	-	-
OS	tp-link	kasa_ec71_firmware	-	-	-

Explore more

Back to dashboard tp-link CVEs kasa_ec70 vulnerabilities

What researchers are saying

CVE-2026-9770

TECHEPAGES[verified]@techepagesPatch

TP‑Link has released firmware updates that address CVE‑2026‑9770 and CVE‑2026‑13230, which involve a hard‑coded crypto key and a location‑leaking discovery service that could enable Man‑in‑the‑Middle attacks; users should update to firmware 2.4.0/2.4.1 or isolate the cameras.

elhacker.NET@elhackernetPatch

The post announces that TP‑Link cameras exposed to CVE-2026-9770 and CVE-2026-13230 can suffer MitM attacks and that the vendor has already issued remediation updates.

Хабр@habr_comDisclosure

CVE‑2026‑9770 is disclosed with an 8.6/10 score, highlighting reused cryptographic keys in camera firmware that break intended security, but no PoC, exploit, patch, or active exploitation is mentioned.

Daily CyberSecurity@Daily_CyberSecPatch

The tweet warns of a local credential‑stealing flaw (CVE‑2026‑9770) in TP‑Link Kasa routers and urges users to update EC70/EC71 firmware, also linking to a potential PoC.

CVE@CVEnewGeneral

The post reports that CVE‑2026‑9770 involves a static cryptographic key shared across Kasa EC71 and EC70 firmware, indicating a potential security weakness.

Daily CyberSecurity@Daily_CyberSecPatch

The post highlights a CVE‑2026‑9770 vulnerability in TP‑Link Kasa EC70/EC71 cameras that allows local attackers to intercept admin credentials and urges users to update firmware to mitigate the issue.

Infoflowcloud@infoflowcloudDisclosure

The tweet announces CVE‑2026‑9770, highlighting a shared static cryptographic key in Kasa firmware, but does not mention any PoC, exploit code, patch, or active exploitation.