What has changed for the Kasa EC70 and EC71?
TP-Link's security advisory, last updated on 15 July 2026, covers two information-disclosure problems in the Kasa EC70 v4 and Kasa EC71 v4 cameras. Retailer listings describe the EC71 as an indoor pan/tilt camera and the EC70 as a mini dome camera, both recording to microSD, though TP-Link notes that models and hardware versions vary by region.
| CVE | Flaw | CVSS v4.0 | What an attacker needs |
|---|---|---|---|
| CVE-2026-9770 | Hardcoded cryptographic key in the system image | 8.6 (High) | Access to the same local network |
| CVE-2026-13230 | Geolocation data exposed in the local discovery response | 5.3 (Medium) | Access to the same local network, no login |
The hardcoded key could let someone on your network compromise the confidentiality of traffic to the camera's web management interface. TP-Link says this could enable man-in-the-middle attacks and theft of administrative credentials. The second flaw lets a device on the same network pull the camera's geolocation data without authenticating, and TP-Link rates its impact as confidentiality-only.
TP-Link lists two fixed builds: 2.4.0 Build 20260520 rel.4191 and 2.4.1 Build 20260621 rel.76536. Its advisory table is hard to read, so check which build your own unit is offered rather than assuming one number applies to every region.
Are the Kasa EC70 and EC71 vulnerabilities exploitable over the internet?
No. Both flaws are rated for attackers on the same local network, so neither is a remote, internet-facing hole. That still matters in a smart home, because a compromised smart plug, a guest on your Wi-Fi or a cracked Wi-Fi password is enough to put an attacker on that network. The camera's own microphone and video feed are exactly what you do not want a stranger probing.
Why does this matter for Home Assistant users?
It matters mainly if you run a Kasa EC70 or EC71 alongside Home Assistant on the same network, because Home Assistant does not integrate these cameras. The official TP-Link integration documentation says only Tapo cameras, doorbells and chimes are currently supported, and it lists no Kasa camera models. If you have one, it is probably running on the Kasa app and cloud, or via a community workaround, rather than a supported local integration.
That makes patching the only real control you have. You cannot lean on Home Assistant to hide or segment the device, so update the firmware and keep it off any network segment that holds sensitive devices. Our home network security guide explains how to put cameras and other IoT devices on a separate network, and the Deco BE11000 router flaw is a reminder that the other TP-Link kit on your network needs the same attention.
How do you update a Kasa EC70 or EC71?
Update the camera firmware from TP-Link's support pages for the EC70 or EC71 v4 and update the Kasa app on your phone, which are the two actions TP-Link recommends. Check the hardware version printed on the camera first, since the advisory only covers version 4 units. If the app offers no update, download the build from your region's TP-Link support page and compare its version number against the fixed builds above.
- Open the Kasa app and update it to the latest version from your app store.
- Open the camera's settings and look for a firmware update option, then install it.
- Confirm the firmware version is at least 2.4.0 Build 20260520 or newer.
- Change the camera account password if you reused it anywhere else.
Should you keep using a Kasa camera or switch?
You do not need to replace the camera: TP-Link has shipped firmware, not a recall, and a patched unit is not at risk from these two flaws. Switch only if you want Home Assistant control, because Tapo cameras are supported by the official integration. Our TP-Link Tapo camera review covers two models that work with it, and the best smart CCTV system guide compares wider options.
What we don't know yet
We could not confirm whether the EC70 and EC71 v4 are sold in the UK, or which of the two fixed builds applies to each model. TP-Link has also not said whether either flaw was exploited. Treat this as a precaution for anyone who already owns one, not an emergency.
