Your Kasa Camera Is Broadcasting Home GPS Coordinates

A security researcher's six-month coordinated disclosure reveals that TP-Link Kasa Spot cameras broadcast precise home GPS coordinates to anyone on the local network with a single UDP packet. The fleet-wide RSA private key and unsalted MD5 credential storage compound the risk. If you bought a used Kasa camera, you may have inherited the previous owner's location data and account credentials.

Introduction

In July 2026, security researcher Christopher Childress (BadChemical) published a comprehensive advisory detailing three vulnerability chains in the TP-Link Kasa Spot EC71 indoor camera. The findings, tracked as CVE-2026-9770 and CVE-2026-13230, expose a pattern of incremental remediation spanning six years: TP-Link fixed an identical GPS leak in their smart plug line in November 2020 but never extended the fix to cameras. A single unauthenticated UDP packet to port 9999 returns sub-meter home coordinates. The same coordinates. Factory reset does not clear this data. A secondhand camera exposes the previous owner's GPS and credentials.

Vulnerability Details

CVE Scores:

CVE-2026-9770: Vendor CVSS 4.0: 8.6 (High) — covers fleet-wide RSA keys and unsalted MD5 credential storage
CVE-2026-13230: Vendor CVSS 4.0: 5.3 (Medium) — GPS exposure; independent researcher assessment: CVSS 4.0: 7.1 (High)

Affected Versions:

Kasa Spot EC71 v4, Firmware 2.3.26 (Build Date: 2024-04-25)
EC70 v4 (confirmed by TP-Link advisory)
KC100 (documented August 2020, identical GPS exposure)
All devices implementing the unauthenticated Smart Home Protocol on UDP port 9999 (documented since July 2016)

Patched Version: Firmware 2.4.1 (released June 24-25, 2026 beta; staged rollout July 2026)

Attack Vector: Local network (UDP port 9999); physical access (SPI flash extraction for credentials)

CWEs:

CWE-321: Use of Hard-coded Cryptographic Key (CVE-2026-9770 Finding 1)
CWE-916: Use of Password Hash With Insufficient Computational Effort (CVE-2026-9770 Finding 2)
CWE-359: Exposure of Private Information (CVE-2026-13230)

Impact Assessment

Finding 1: Hardcoded Fleet-Wide RSA Private Keys (CVE-2026-9770)

The firmware contains two complete fleet-wide RSA key/certificate pairs across two SquashFS layers. The primary layer contains a legacy 1024-bit RSA key from 2014 (expired July 2024, SHA1). The secondary layer contains the active 2048-bit RSA key from 2021 (valid until July 2031, SHA256). Both keys are identical across all devices running this firmware build and extractable from SPI flash.

Impact: Any attacker who extracts the private key from one device possesses the cryptographic material for the entire deployed fleet. The device serves the 2021 certificate at runtime. While primary communication may route through the cloud (ARP spoofing MITM did not intercept local app-to-device traffic), the fleet-wide key represents a fundamental cryptographic failure.

Finding 2: Unsalted MD5 Storage of TP-Link ID Credentials (CVE-2026-9770)

User cloud account credentials are stored in config/account as an unsalted MD5 hash. The email address is stored in plaintext. TP-Link ID provides unified authentication across Kasa, Tapo, Deco, VIGI, Omada, and Aginet products.

Cross-Domain Impact: Cracking the unsalted MD5 hash is trivial with modern rainbow tables or GPU-accelerated brute force. A compromised TP-Link ID grants access to smart locks (physical access bypass), Deco mesh systems (network infrastructure takeover), and VIGI commercial surveillance equipment.

Finding 3: Unauthenticated GPS Exposure via UDP Port 9999 (CVE-2026-13230)

A single unauthenticated UDP packet {"system":{"get_sysinfo":{}}} sent to port 9999 returns a full JSON response containing:

Precise GPS coordinates (sub-meter accuracy)
Unique hardware identifiers (oemId, hwId, deviceId, mac, mic_mac)
User-assigned device alias
Full firmware version string

The response is protected only by a trivial XOR cipher that Wireshark decodes natively. No authentication token, session credential, or prior device setup is required.

GPS Storage Context: Coordinates are sourced from the mobile device's GPS at account creation and stored permanently in config/location within the jffs2 overlay. They do not rotate (manual sync available). The Kasa geofencing beta launched September 2023 — three years after GPS exposure was publicly documented (August 2020). TP-Link's own geofencing documentation confirms the feature relies on mobile device GPS, not camera-stored coordinates.

CCPA Implications: TP-Link's Kasa Privacy Policy (September 2024) discloses precise location collection only in the context of geofencing enablement. The California supplement limits geolocation disclosure to state/country by IP. Yet sub-meter coordinates are collected at account creation and broadcast unauthenticated regardless of geofencing opt-in status.

Affected Systems

Confirmed (TP-Link Advisory):

Kasa Spot EC71 v4
Kasa Spot EC70 v4

Documented by Independent Research:

KC100 (August 2020, identical GPS exposure on port 9999)
All devices implementing the unauthenticated Smart Home Protocol on port 9999 (documented July 2016 by softScheck for HS110 smart plugs)

Potentially Affected (Not Verified):

KC110, KC115, KC410S, KC411S, and other Kasa Spot Pan-Tilt family devices
Any TP-Link camera sharing the vulnerable firmware codebase

The six-year documented history across multiple hardware generations suggests scope extends beyond listed models.

Mitigation & Patching

Immediate Actions:

Update Kasa Spot EC70/EC71 to firmware 2.4.1 via the Kasa app
Verify update completion in Device Settings > Firmware Version
If auto-update is disabled, manually check for updates

Firmware 2.4.1 Remediations (Confirmed by Researcher Beta Validation):

Fleet-wide RSA keys removed entirely; replaced with per-device EC keys provisioned via NOC certificate infrastructure; mbedTLS upgraded 2.6.0 to 2.28.1
Credential storage encrypted via at-rest encryption rollout using device's existing AES routine
GPS coordinates removed from get_sysinfo response; port 9999 no longer responds to unauthenticated get_sysinfo requests
Kasa app now broadcasts public RSA key via UDP for authenticated local discovery

Secondary Market Risk Mitigation:

Before selling/donating a Kasa camera: factory reset, then verify no GPS/credential data remains (requires SPI flash extraction to confirm fully)
When buying used: assume previous owner's GPS coordinates and TP-Link ID credentials are recoverable; rotate your TP-Link ID password immediately after setup
Firmware 2.4.1 addresses both paths: GPS removed from soft AP response, credentials encrypted

Detection

Network-Level Detection (Suricata)

yaml

Host-Level Detection (YARA)

yara

Physical Detection (SPI Flash)

bash

Sigma Rule for Network Monitoring

yaml

Frequently Asked Questions

Q: Is this exploitable over the internet? A: No. The GPS exposure requires local network access (UDP port 9999). However, if the camera is placed in DMZ or port-forwarded, internet exposure occurs. The secondary market attack requires only physical possession of the device.

Q: Why did TP-Link score the GPS finding as Medium (5.3)? A: The vendor classified precise home coordinates as low confidentiality impact. The researcher's independent CVSS 4.0 assessment is 7.1 (High), reflecting that sub-meter residential location data enables stalking, burglary planning, and physical security risks.

Q: Does this affect Tapo cameras? A: The advisory notes Tapo-branded beta endpoints in the Kasa firmware, suggesting shared backend infrastructure. Tapo cameras were not explicitly tested but may share the same protocol.

Q: Why did the beta firmware brick the test device? A: Beta 2.4.0 (delivered June 11, 2026) permanently bricked the researcher's test device via OTA. Factory reset was non-functional. Recovery required a CH341A SPI programmer. Consumer devices experiencing the same failure would be unrecoverable without hardware intervention. TP-Link confirmed no software recovery path.

Q: What about the unsalted MD5 hash — isn't MD5 broken? A: Yes. Unsalted MD5 is trivially cracked with rainbow tables (precomputed) or GPU-accelerated brute force (billions of hashes/second). The cross-domain nature of TP-Link ID amplifies the impact: one cracked hash compromises smart locks, mesh networks, and commercial surveillance.

Q: How many devices are affected? A: TP-Link has not disclosed deployment numbers. The Kasa product line has been sold globally since 2015. The vulnerability affects all EC70/EC71 units on firmware 2.3.26 and potentially earlier builds sharing the same codebase.

Key Takeaways

Six years of documented GPS exposure — TP-Link knew about this vulnerability class since 2016 (smart plugs) and 2020 (KC100 cameras) but applied fixes incrementally rather than comprehensively.
Fleet-wide cryptographic material is a systemic risk — Identical RSA keys across all devices means one physical extraction compromises the entire product line.
Factory reset is not data sanitization — IoT vendors must treat credential and PII storage as requiring explicit cryptographic erasure, not just filesystem reset.
Coordinated disclosure works but requires accountability — The six-month timeline included vendor triage failures, a bricked test device, and an extension request the researcher declined. Public disclosure forced the final patch.
Secondary market is an attack vector — Returned, refurbished, and resold IoT devices carry previous owners' sensitive data. Vendors must design for ownership transfer.

Conclusion

The TP-Link Kasa EC71 vulnerabilities illustrate how IoT security fails not from sophistication but from neglect: a known protocol flaw left unpatched for six years, fleet-wide keys that should never exist, credential storage that ignores basic salting, and a factory reset that doesn't reset. If you operate Kasa cameras, update to 2.4.1 today. If you bought one used, rotate your TP-Link credentials and assume your home coordinates are exposed.

Sources:

Automated Transmission

This entry was synthesized and populated dynamically using native API integrations.

Hello.

TP-Link Kasa Cameras Leaked Home GPS for Six Years: CVE-2026-9770, CVE-2026-13230