Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-9770

Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices.  An attacker with access to the firmware image can extract the embedded key.  Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encrypted communications. This may enable passive decryption of traffic or active man-in-the-middle (MITM
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:89664c8e7bbf8d897ad835d9d3f1d343369c8547109b1d88fd968c4b6f665d28
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Kasa EC71 v4","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"2.4.0 Build 20260520 rel.4191","status":"affected","version":"0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:105e808ca8b0c3dbfa307f11384c7c34a15fa71940f4328498347c1b2beff641 · sha256:5c0ba6aaa2a4c06e… · /containers/cna/affected/0

{"defaultStatus":"unaffected","product":"Kasa EC70 v4","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"2.4.0 Build 20260520 rel.4191","status":"affected","version":"0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:105e808ca8b0c3dbfa307f11384c7c34a15fa71940f4328498347c1b2beff641 · sha256:5c0ba6aaa2a4c06e… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Kasa EC71 v4","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"2.4.0 Build 20260520 rel.4191","status":"affected","version":"0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:105e808ca8b0c3dbfa307f11384c7c34a15fa71940f4328498347c1b2beff641 · sha256:5c0ba6aaa2a4c06e… · /containers/cna/affected/0
{"defaultStatus":"unaffected","product":"Kasa EC70 v4","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"2.4.0 Build 20260520 rel.4191","status":"affected","version":"0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:105e808ca8b0c3dbfa307f11384c7c34a15fa71940f4328498347c1b2beff641 · sha256:5c0ba6aaa2a4c06e… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":8.6,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":…
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:105e808ca8b0c3dbfa307f11384c7c34a15fa71940f4328498347c1b2beff641 · sha256:5c0ba6aaa2a4c06e… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-321","description":"CWE-321 Use of hard-coded cryptographic key","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:105e808ca8b0c3dbfa307f11384c7c34a15fa71940f4328498347c1b2beff641 · sha256:5c0ba6aaa2a4c06e… · /containers/cna/problemTypes/0/descriptions/0

Source references

5 source assertions
{"tags":["patch"],"url":"https://www.tp-link.com/en/support/download/ec70/v4/#Firmware-Release-Notes"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:105e808ca8b0c3dbfa307f11384c7c34a15fa71940f4328498347c1b2beff641 · sha256:5c0ba6aaa2a4c06e… · /containers/cna/references/3
{"tags":["patch"],"url":"https://www.tp-link.com/en/support/download/ec71/v4/#Firmware-Release-Notes"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:105e808ca8b0c3dbfa307f11384c7c34a15fa71940f4328498347c1b2beff641 · sha256:5c0ba6aaa2a4c06e… · /containers/cna/references/0
{"tags":["patch"],"url":"https://www.tp-link.com/us/support/download/ec70/v4/#Firmware-Release-Notes"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:105e808ca8b0c3dbfa307f11384c7c34a15fa71940f4328498347c1b2beff641 · sha256:5c0ba6aaa2a4c06e… · /containers/cna/references/2
{"tags":["patch"],"url":"https://www.tp-link.com/us/support/download/ec71/v4/#Firmware-Release-Notes"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:105e808ca8b0c3dbfa307f11384c7c34a15fa71940f4328498347c1b2beff641 · sha256:5c0ba6aaa2a4c06e… · /containers/cna/references/1
{"tags":["vendor-advisory"],"url":"https://www.tp-link.com/us/support/faq/5192/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:105e808ca8b0c3dbfa307f11384c7c34a15fa71940f4328498347c1b2beff641 · sha256:5c0ba6aaa2a4c06e… · /containers/cna/references/4

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer