TP-Link Patches Fleet-Wide RSA Keys and Decades-Old UDP GPS Leak in Kasa Cameras
A technical audit of the TP-Link Kasa Spot EC71 camera has exposed a critical vulnerability chain including unauthenticated UDP GPS leaks, hardcoded fleet-wide RSA private keys, and unsalted MD5 credential storage. After a six-month coordinated disclosure process that permanently bricked test hardware, TP-Link resolved these architectural issues with the release of firmware version 2.4.1.
Firmware Extraction and Cryptographic Failures
Physical extraction of the Kasa Spot EC71 (Firmware 2.3.26) firmware was achieved using a CH341A programmer reading directly from the onboard SPI flash chip. File system analysis of the extracted image revealed a critical cryptographic failure: the presence of two fleet-wide RSA private key and certificate pairs distributed across two distinct SquashFS layers.
The primary layer, designated as `squashfs-root`, contains a legacy 1024-bit RSA key and certificate pair issued by TPRI-CA in 2014. This certificate expired in July 2024 and utilizes a weak SHA1 signature. The secondary layer, `squashfs-root-0`, houses the active 2048-bit RSA key and certificate pair issued by CN=TP-Link in 2021, valid through July 2031, and signed with SHA256.
Because these cryptographic assets are identical across every manufactured EC71 unit running this firmware branch, any attacker capable of extracting the active private key from a single physical device gains the capability to compromise the transport security and identity of the entire deployed fleet.
Unauthenticated UDP GPS Leak and Secondary Market Risks
The most severe privacy vulnerability, tracked as CVE-2026-13230, is an unauthenticated UDP protocol leak that exposes precise GPS coordinates. While TP-Link remediated an identical class of vulnerability within its smart plug product line in November 2020, the camera line remained vulnerable. The underlying unauthenticated protocol has been exposed since July 2016, and specifically within TP-Link's camera products since August 2020. This indicates an incremental, reactive patching policy rather than a cohesive system-wide codebase review.
Furthermore, the device's credential storage mechanism relies on unsalted MD5 hashing. Combined with the localized storage of GPS coordinates, this creates a viable secondary market attack vector. If a user sells or discards a device after performing a standard factory reset, a subsequent owner can still extract the previous owner's unsalted credential hashes and precise physical coordinates directly from the SPI flash.
Coordinated Disclosure and Firmware Validation Hazards
The remediation process spanned six months of coordinated disclosure beginning on January 5, 2026. The timeline highlighted significant triage and validation hurdles. During initial assessments in May 2026, TP-Link's product security team failed to accurately triage the GPS leak, referencing an MD5 hash field that was entirely absent from the reported JSON payload. The researcher had to supply a video proof-of-concept to bypass the triage error.
Subsequent remediation testing resulted in hardware-level failures. On June 15, 2026, an over-the-air (OTA) update to beta firmware 2.4.00 permanently bricked the researcher's test camera. The device entered an unrecoverable bootloop characterized by a repeating LED pattern of 25 green pulses followed by a single red pulse, with the physical factory reset button rendered non-functional.
TP-Link replaced the ruined unit, enabling validation of beta firmware 2.4.1. The updated firmware successfully remediated the hardcoded RSA keys, migrated the insecure credential storage, and disabled the unauthenticated UDP GPS exposure.