← Vulnerability feed

Vulnerability record · CVE-2026-9770 · published 15 July 2026

CVE-2026-9770: Tp-link kasa ec71 firmware vulnerability

Tp Link · Kasa Ec71 Firmware

Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices.  An attacker with access to the firmware image can extract the embedded key.  Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encrypted communications. This may enable passive decryption of traffic or active man-in-the-middle (MITM) attacks

8.6 CVSS 4.0 High EPSS 0.31% · top 78.5% CWE-321 · CWE-321
8.6CVSS 4.0 base score
0.31%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
5References
6 Aug 2026Last modified by NVD

Description

Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices.  An attacker with access to the firmware image can extract the embedded key.  Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encrypted communications. This may enable passive decryption of traffic or active man-in-the-middle (MITM) attacks

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.tp-link.com/en/support/download/ec70/v4/#Firmware-Release-Notes Release Notes
https://www.tp-link.com/en/support/download/ec71/v4/#Firmware-Release-Notes Release Notes
https://www.tp-link.com/us/support/download/ec70/v4/#Firmware-Release-Notes Release Notes
https://www.tp-link.com/us/support/download/ec71/v4/#Firmware-Release-Notes Release Notes
https://www.tp-link.com/us/support/faq/5192/ Vendor Advisory

Track CVE-2026-9770 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

5.3CVE-2026-13230Tp-link kasa ec70 firmware information exposure vulnerabilityAn information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive …EPSS 0.40%9.8CVE-2025-30406Gladinet CentreStack hardcoded machineKey deserialization RCEGladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) uses a hardcoded machineKey in the portal's web.config, allowing deserializ…KEVEPSS 94%analysed9.8CVE-2016-4437Apache Shiro hardcoded remember-me cipher key enables code executionApache Shiro before 1.2.5 uses a default cipher key for the "remember me" feature when no key is configured, allowing attackers to forge or decrypt r…KEVEPSS 93%analysed

Source: NIST National Vulnerability Database (record CVE-2026-9770), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.