PatchTheCVECVE-2026-13230: An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discov
CVE-2026-13230 is a medium-severity flaw (CVSS 6.5) affecting kasa ec70 firmware, kasa ec71 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related data through crafted responses. The vulnerability impacts confidentiality only, with no evidence of integrity of availability impact.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Adjacent network |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 66%) |
| CISA exploited list | No |
| Weakness | CWE-200 |
| Published | 2026-07-15 |
| Last modified | 2026-08-06 |
Last updated 2026-08-06 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-13230?
kasa ec70 firmware: upgrade to 2.4.1; kasa ec71 firmware: upgrade to 2.4.1. Exact commands for each OS are on this page.
Is CVE-2026-13230 being exploited?
CVE-2026-13230 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-13230 affect?
CVE-2026-13230 affects kasa ec70 firmware, kasa ec71 firmware. Severity is medium (CVSS 6.5). An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on
How urgent is CVE-2026-13230?
Priority 31/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2026-9770 MEDIUM 5.3 UPGRADE UPGRADE Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem