← Back

CVE-2026-13230

nvd nist
Published: Jul 15, 2026Modified: Aug 6, 2026

JSON object

Loading...
5.3
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: f23511db-6c3e-4e32-a477-6aa17d310630 (Secondary)

Description

An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related data through crafted responses. The vulnerability impacts confidentiality only, with no evidence of integrity of availability impact.

Affected (2)

Tp Link
2 products
Kasa Ec70 Firmware
Kasa Ec71 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Kasa Ec70 Firmware
Before 2.4.1
Running on/withPlatform Versions
Tp Link
Kasa Ec70
Version 4.0
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Kasa Ec71 Firmware
Before 2.4.1
Running on/withPlatform Versions
Tp Link
Kasa Ec71
Version 4.0

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (5)

Source: f23511db-6c3e-4e32-a477-6aa17d310630
Release Notes
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Release Notes
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Release Notes
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Release Notes
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Vendor Advisory

Timeline

No history available yet.