CVE-2026-9770

Name of the Vulnerable Software and Affected Versions Kasa EC71 v4 Kasa EC70 v4

Description The firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access to the firmware image can extract this embedded key. Successful exploitation may allow an unauthenticated attacker on the same network to use the key within the web management service, compromising the confidentiality of encrypted communications. This can lead to the theft of admin credentials through passive decryption of traffic or active man-in-the-middle (MITM) attacks, where an attacker intercepts and potentially alters communication between two parties.

Recommendations Update the firmware for Kasa EC71 v4. Update the firmware for Kasa EC70 v4.