TP-Link Kasa Camera Flaws Let Attackers Steal Admin Credentials and Location Data

TP-Link has disclosed two security vulnerabilities affecting its Kasa EC70 v4 and EC71 v4 smart camera models, which could let attackers on the same local network intercept administrative credentials and extract sensitive geolocation data. The more severe flaw, tracked as CVE-2026-9770, stems from a hardcoded cryptographic key embedded directly in the device’s system image. This hardware-level exposure undermines the confidentiality of communications between the camera…