PatchTheCVECVE-2026-9770: Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem
CVE-2026-9770 is a medium-severity flaw (CVSS 5.3) affecting kasa ec71 firmware, kasa ec70 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access to the firmware image can extract the embedded key. Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encrypted communications. This may enable passive decry
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Adjacent network |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 76%) |
| CISA exploited list | No |
| Weakness | CWE-321 |
| Published | 2026-07-15 |
| Last modified | 2026-08-06 |
Last updated 2026-08-06 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-9770?
kasa ec71 firmware: upgrade to 2.4.0; kasa ec70 firmware: upgrade to 2.4.0. Exact commands for each OS are on this page.
Is CVE-2026-9770 being exploited?
CVE-2026-9770 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-9770 affect?
CVE-2026-9770 affects kasa ec71 firmware, kasa ec70 firmware. Severity is medium (CVSS 5.3). Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access to the firmware image can extract the embedded key. Successful
How urgent is CVE-2026-9770?
Priority 25/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2026-13230 MEDIUM 6.5 UPGRADE UPGRADE An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discov