TP-Link Kasa cameras broadcast owners' home GPS unauthenticated for six years

Researcher Christopher Childress physically extracted firmware from a TP-Link Kasa Spot EC71 indoor camera and confirmed three vulnerability chains, all now patched in version 2.4.1. The most striking: a single unauthenticated UDP packet to port 9999 returns a JSON payload containing the owner’s precise home GPS coordinates, hardware identifiers, device alias, and firmware version, obfuscated only by a trivial XOR that Wireshark decodes automatically. The coordinates are captured from the owner’s phone at setup and stored permanently without rotation, giving anyone on the network a static fix on where the camera lives. This exact behavior was documented on TP-Link’s KC100 camera in 2020, and the underlying unauthenticated Smart Home Protocol has been public since 2016 — TP-Link even fixed the equivalent flaw in its smart plugs in November 2020 but never carried the remediation over to its cameras.

The cryptographic and credential findings compound the exposure. Every device running the affected build ships the same fleet-wide 2048-bit RSA private key, extractable from any single unit’s SPI flash, so compromising one camera yields cryptographic material for the entire fleet. Worse, cloud account passwords are stored as unsalted MD5 hashes alongside the user’s plaintext TP-Link ID email. Because TP-Link ID is a unified login spanning Tapo smart locks, Deco mesh routers, VIGI surveillance gear, and more, cracking one trivially reversible hash can cascade into full cross-domain account takeover — including physical door locks and entire home networks.

A secondary attack path lets a subsequent owner of a resold, factory-reset camera recover the previous owner’s credentials and GPS location, turning the secondhand market into a data-leak vector. Childress frames the disclosure as evidence of a broader pattern: TP-Link repeatedly patches individual product lines in isolation rather than auditing shared components across its catalog, leaving known-vulnerable code in shipping products for years. The six-month coordinated disclosure also surfaced vendor triage failures and bricked a test device requiring hardware-level recovery.