IoT-Vulnerability-Research-Public/TP-Link_Kasa_EC71/Kasa_EC71.md at main · BadChemical/IoT-Vulnerability-Research-Public
Pangram verdict · v3.3
We believe that this document is a mix of AI-generated, AI-assisted, and human-written content
AI likelihood · overall
MixedArticle text · 1,533 words · 6 segments analyzed
Security Advisory: Kasa Spot EC71 (Firmware 2.3.26) Author: Christopher Childress (BadChemical) Status: Patched, CVE-2026-9770 (RSA/IAM) and CVE-2026-13230 (GPS) remediated in 2.4.1. Vendor: TP-Link Systems Inc. / Kasa Product: Kasa Spot EC71 Firmware Version: 2.3.26 (Build Date: 20240425, Release ID: 33797) Patched Firmware: 2.4.1 CVE: CVE-2026-9770 / CVE-2026-13230 Published: July 16th, 2026
Legal Disclaimer This repository contains proof of concept for patched vulnerabilities in TP-Link Kasa Spot EC71 indoor cameras. This information is published strictly for educational purposes and defensive research. The vendor was contacted in accordance with standard Coordinated Vulnerability Disclosure protocols on January 5, 2026. All three primary findings, fleet-wide RSA key, unsalted MD5 credential storage, and unauthenticated GPS exposure, have been remediated in v2.4.1. All device-specific identifiers, credential hashes, and global private keys have been heavily redacted to prevent abuse.
Summary A comprehensive security analysis of the Kasa Spot EC71 revealed multiple vulnerabilities compromising the device's confidentiality, integrity, and availability. The firmware was extracted physically via a CH341A programmer reading directly from the SPI flash chip, followed by active network packet analysis and hardware analysis. Three primary vulnerability chains, cryptographic failures, insecure credential storage, and unauthenticated exposure of precise location data, were confirmed and remediated in v2.4.1 following a multi component architectural redesign spanning six months of coordinated disclosure. The disclosure process included documented triage failures and firmware validation, resulting in a permanently bricked test device that required hardware level recovery. The GPS exposure documented in this advisory has been publicly known since August 2020 across TP-Link's camera product line and since July 2016 for the underlying unauthenticated protocol.
TP-Link remediated an identical vulnerability class in the smart plug product line in November 2020, but did not extend that remediation to the camera product line. This advisory documents a pattern of targeted, incremental remediation rather than a comprehensive architectural security review. A secondary market attack path enables recovery of the previous owner's credentials and GPS coordinates from devices returned to factory settings.
Coordinated Disclosure Timeline
Date Event
Jan 05, 2026 Initial security advisory sent to product security team
Jan 14, 2026 Vendor acknowledged report; clarified production firmware version (v2.3.26)
Jan 16, 2026 Vendor requested clarification and PoC scripts. Vendor committed to remediating "issues related to the local communication TLS certificates" in the next software release
Jan 27, 2026 Vendor confirmed Finding 1 (RSA Keys) and Finding 2 (Insecure Credentials). Findings 4, 5, 6, and 7 closed as accepted risk/out of scope under CNA Operational Rule 4.1.2
Jan 30, 2026 Vendor confirmed CNA role for CVE assignment. Cross-domain compromise impact escalated
Mar 23, 2026 Vendor requested extension to early June for cross-system architectural redesign. Extension granted. Additional GPS finding submitted with PoC script
Mar 24, 2026 Vendor created internal ticket TPVD20260324001 for GPS finding
Apr 21, 2026 Vendor acknowledged GPS finding, split to separate disclosure timeline, committed to providing progress updates
May 23, 2026 Status follow-up sent; no milestone updates
received in two months despite vendor commitment
May 29, 2026 Vendor triage response for TPVD20260324001 referenced an MD5 hash field not present in the reported payload or device JSON response, confirming the finding was not reviewed prior to response
May 29, 2026 Rebuttal submitted with video PoC documenting triage failure.
Jun 05, 2026 Vendor requested open-ended extension to GPS disclosure deadline. Extension declined. June 22nd deadline confirmed
Jun 05, 2026 Vendor confirmed CVE-2026-9770 advisory planned for Monday or Tuesday at the latest. Advisory not published
Jun 10, 2026 Vendor disclosed CVE-2026-9770 firmware rollback due to performance instability at 60% grayscale deployment. Extension to June 30th requested. Beta firmware for validation offered. First substantive technical context for GPS remediation complexity provided
Jun 11, 2026 CVE-2026-9770 embargo extended to June 30th. GPS disclosure converted to a trigger event basis: published simultaneously with the CVE-2026-9770 advisory and firmware release. Beta validation accepted
Jun 15, 2026 Beta firmware 2.4.00 OTA rendered test device permanently unresponsive. Factory reset is non functional. LED pattern: approximately 25 green pulses followed by one red pulse, cycling continuously
Jun 19, 2026 Vendor confirmed no software recovery path after engineering review. Reimbursement for the replacement device arranged
Jun 21, 2026 Replacement device received
Jun 24, 2026 Beta firmware 2.4.1 staged to replacement device. Beta Kasa app provided via TestFlight
Jun 25, 2026 Beta 2.4.1 validation completed.
All primary findings were confirmed remediated
Jun 26, 2026 Vendor confirmed staged rollout across 1.5 - 2 weeks underway; CVE issuance planned at rollout completion
Jul 10, 2026 Status update sent, publication expected next week
Jul 14, 2026 Publication, GPS CVE issued
CVE-2026-9770 Vendor CVSS 4.0: 8.6
Note: CVE-2026-9770 was assigned by TP-Link as CNA to cover both findings below. These represent distinct vulnerabilities with separate CWEs and independent attack paths.
Finding 1 — Hardcoded RSA Private Keys CWE: CWE-321 / CWE-327 Status: Patched in firmware 2.4.1 Description: The firmware contains two complete fleet wide RSA key/cert pairs across two SquashFS layers. The primary SquashFS squashfs-root contains a legacy 1024-bit RSA key/cert pair issued by TPRI-CA in 2014, expired July 2024, signed with SHA1. The secondary SquashFS layer squashfs-root-0 contains the active 2048-bit RSA key/cert pair issued by CN=TP-Link in 2021, valid until July 2031, signed with SHA256. Both key/cert pairs were confirmed coherent via public key comparison. Both are fleet wide and identical across all devices running this firmware build. The device serves the 2021 certificate at runtime. Both private keys can be extracted from SPI flash. Impact: The active 2048-bit RSA private key in squashfs-root-0 is extractable from any EC71 unit via SPI flash and is identical across all devices running this firmware build. This key corresponds to the certificate the device serves at runtime. An attacker who extracts this key from any single device possesses the cryptographic material for the entire deployed fleet. A legacy 1024-bit key/cert pair from 2014 is also present in the primary SquashFS, but it corresponds to an expired certificate that is no longer served at runtime and has no practical exploitation value.
An ARP spoofing MITM attempt against local app-to-device traffic did not intercept data, suggesting primary communication may route through the cloud. The practical exploitability of the extracted fleet-wide key for active traffic interception was not demonstrated. The vendor characterized this as "issues related to the local communication TLS certificates" in their January 16, 2026, response.
Finding 2 — Insecure Storage of User Passwords & Cross-Domain Compromise CWE: CWE-916 Status: Patched in v2.4.1 Description: User cloud account credentials are stored in config/account as an unsalted MD5 hash across two filesystem partitions. The read-only SquashFS filesystem contains factory default credentials (admin/admin) as placeholder values. At runtime, the jffs2 overlay overwrites this file with the authenticated user's actual TP-Link ID email address in plaintext, and the password is stored as an unsalted MD5 hash. Cross-Domain Impact: Per TP-Link publication 'TP-Link ID offers a unified authentication service to allow you use a single email address to access the TP-Link Community, Omada Cloud, Training Systems as well as management for your TP-Link products and TP-Link Apps such as Deco, Tether, Kasa, Tapo, Aginet, Omada, and VIGI'. While each platform maintains its own interface, the TP-Link ID credentials are global. Cracking this unsalted MD5 hash is trivial with modern rainbow tables, and full hash space brute force can be achieved via GPU cluster acceleration, enabling full cross domain account takeover across all TP-Link products used by the user. This includes high-impact devices such as Tapo smart locks (remote physical access control bypass), Deco mesh network systems (full network infrastructure takeover), or VIGI commercial surveillance equipment.
CVE-2026-13230 Finding 3 — Unauthenticated Precise GPS exposure & Device Fingerprinting CWE: CWE-359 Status: Patched in firmware 2.4.1 Vendor CVSS 4.0: 5.3 Researcher CVSS 4.0: 7.1 Description: A single unauthenticated UDP packet containing {"system":{"get_sysinfo":{}}} sent to port 9999 returns a full JSON response exposing precise GPS coordinates, unique hardware identifiers (oemId, hwId, deviceId, mac, mic_mac), user-assigned device alias, and full firmware version string. This data is protected only by a trivial XOR cipher, which Wireshark natively decodes as cleartext. No authentication token, session credential, or prior device setup is required to trigger this response. GPS coordinates are sourced from the mobile device's GPS at account creation and stored permanently in the device's firmware. They do not rotate (manual syncing is available), providing a static record of the device owner's home location. Protocol History: The unauthenticated nature of TP-Link's Smart Home Protocol on port 9999 has been publicly documented since July 2016, when softScheck published reverse engineering research on the HS110 explicitly stating: "No authentication: Anybody on the local network can turn the Smart Plug on and off, reset it or render it inoperable." A public Python client and Wireshark dissector were released simultaneously. Independent research published in August 2020 documented identical unauthenticated GPS coordinate exposure via port 9999 on the TP-Link KC100, a Kasa indoor pan-tilt camera. EC71 firmware built in April 2024 exhibited the same behavior on the same port using the same protocol. Standard vulnerability management practice requires identifying all products that share a vulnerable component and verifying remediation across the entire affected scope.
Note: In the 2016 softScheck publication, GPS data was labeled as an optional field. The 2020 publication contained precise coordinates; the trigger to populate the previously optional field was not identified.