TP-Link Kasa EC70 and EC71 Static Cryptographic Key Information Disclosure Vulnerability

A vulnerability exists in the Kasa EC70 v4 and EC71 v4 firmware due to a hardcoded cryptographic private key stored in a read-only filesystem, shared across devices. An attacker with access to the firmware image can extract this key. Exploitation may allow an unauthenticated attacker on the same network to use the key in the web management service, compromising the confidentiality of encrypted communications. This could lead to passive decryption of traffic or active man-in-the-middle attacks.

Impact

Exploitation of this vulnerability could result in unauthorized interception and decryption of communications with the device's web management interface, potentially allowing access to administrative credentials.

Remediation

Users are advised to update to the latest firmware version. The patched version for the Kasa EC70 and EC71 is 2.4.0 Build 20260520 or 2.4.1 Build 20260621. Instructions for downloading the firmware are available on the TP-Link website.