- Published on
TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years
- Authors
- Name
- DeepHorus
Security researchers have uncovered multiple critical vulnerabilities in TP-Link's Kasa Spot EC71 indoor cameras, including a flaw that exposed homeowners' precise GPS coordinates via an unauthenticated UDP protocol for six years. The findings, disclosed by researcher Christopher Childress and published on July 16, 2026, reveal that the cameras leaked location data without authentication since at least August 2020, with the underlying protocol vulnerable since July 2016. TP-Link has patched the issues in firmware version 2.4.1, but the disclosure process was marked by documented triage failures that resulted in a permanently bricked test device requiring hardware-level recovery.
The vulnerabilities were discovered through physical extraction of firmware via a CH341A programmer reading directly from the SPI flash chip, combined with network packet analysis. Three primary vulnerability chains were confirmed: cryptographic failures involving fleet-wide RSA keys, insecure credential storage using unsalted MD5 hashes, and unauthenticated exposure of precise location data. The GPS exposure issue had been publicly known for years across TP-Link's camera product line, yet the company had only remediated an identical vulnerability class in its smart plug line in November 2020, without extending the fix to cameras.
The most alarming finding involves two complete fleet-wide RSA key/certificate pairs stored across two SquashFS layers within the firmware. One pair uses a legacy 1024-bit key issued in 2014, expired July 2024, signed with SHA1; the other uses an active 2048-bit key issued in 2021, valid until July 2031, signed with SHA256. Both private keys can be extracted from any device's SPI flash, meaning an attacker who compromises a single unit gains cryptographic material for the entire deployed fleet. The active key corresponds to the certificate the device serves at runtime, enabling potential man-in-the-middle attacks, though cloud routing may limit local interception.
Additionally, the cameras store user credentials with unsalted MD5 hashing, a decades-old insecure practice. This flaw, combined with the unauthenticated GPS exposure, creates a secondary market attack path: attackers can recover the previous owner's credentials and GPS coordinates from devices returned to factory settings without proper sanitization. The vendor assigned a CVSS 4.0 score of 8.6 to the overall vulnerability chain, with separate CVEs for the cryptographic failures (CVE-2026-9770) and GPS exposure (CVE-2026-13230).
TP-Link has released firmware version 2.4.1 to address all three primary findings, including a multi-component architectural redesign. However, the company's incremental remediation approachâfixing similar issues in smart plugs but not cameras for yearsâhas drawn criticism from security experts. The disclosure process, initiated on January 5, 2026, took over six months, with documented validation failures that led to the bricked test device.
Moving forward, owners of Kasa Spot EC71 cameras are urged to update to firmware 2.4.1 immediately and reset any second-hand devices to clear stored credentials. The incident underscores the importance of comprehensive security audits across entire product lines rather than piecemeal fixes. For TP-Link, the exposure of a six-year-old vulnerability pattern highlights the need for proactive cryptographic key management and default-deny network protocols to prevent similar privacy breaches in future IoT devices.
