CVE-2026-9770

Katalog CVE

CVSS 5.3 · Medium EPSS 0,31%

Kerentanan Use of Hard-coded Cryptographic Key pada tp-link kasa ec71 firmware, tp-link kasa ec70 firmware. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices.  An attacker with access to the firmware image can extract the embedded key.  Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encrypted communications. This may enable passive decryption of traffic or active man-in-the-middle (MITM) attacks

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

6 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-321: Use of Hard-coded Cryptographic Key

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.tp-link.com/us/support/faq/5192/ advisory vendor
• https://www.tp-link.com/en/support/download/ec70/v4/#Firmware-Release-Notes release notes
• https://www.tp-link.com/en/support/download/ec71/v4/#Firmware-Release-Notes release notes
• https://www.tp-link.com/us/support/download/ec70/v4/#Firmware-Release-Notes release notes
• https://www.tp-link.com/us/support/download/ec71/v4/#Firmware-Release-Notes release notes