TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years • Hacker News Board

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#21

Post by holgerschurig » Sat, Jul 18, 2026, 6:10 AM UTC

qurren wrote: post #14

afavour wrote: post #13

Earlier quoted context omitted.

> It would be a no-go for non-techies. There are better solutions, like Apple’s HomeKit. I’m able to watch a camera that has no internet access because it passed through my Apple TV, which serves as a home hub. I didn’t have to set any of this up, it just works when you have the required hardware.

HomeKit will take care of the VPN/remote access part, sure, but your devices still need to communicate with the HomeKit device, and that's usually over Wi-Fi, which puts the devices on the public internet, and carries the same security risk. There are various non-internet protocols for IoT devices, none of them good: * Zigbee: Requires some technical understanding to set up, devices randomly disconnect for hours even…

> Zigbee

Requires no technical understanding. At least not more than e.g. a WIFI router.

> devices randomly disconnect for hours even when they are 2ft from the coordinator,

You present this like a fact. But it is at most an anecdote. I present you a different anecdote: I have ~30 zigbee devices, in two different houses (first a house with concrete floors and cellar and level 1..3) and now one old woodwork structure house with 2 floors. Nowhere did I had even half an hour of disconnection.

> all around-horrible

... excellent experience even for my ex-spouse, which is/was non-techie.

However, that you present Zigbee here at all is weird. Zigbee doesn't have any way to transport a camera stream. It's mean for low-powered battery devices. My temperature sensors got a 1500mAh AAA chargeable batteries and they lasts now for over one year. Note that I have sensors from ~ 15 different brands. Mostly battery powered sensors and mains power switchable plugs.

I also enjoy that these Zigbee devices are by design completely disconnected from any IP traffic. This, and their (intentional) low data rate make them almost impossible to misuse. E.g. as denial-of-service originators or amplifiers.

It's like you present WIFI as long-range thingy but actually you'd want LORA for that. I'm not assuming that knowing for what kind of usage a tech was designed as "needing technical understanding". After all, no one would claim "you need technical understanding" to know that you better use a truck instead of a Porsche Cayman to transport 50 cubic meters of sand.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#22

Post by armel_N » Sat, Jul 18, 2026, 6:14 AM UTC

BadChemical wrote: post #2

Six months of coordinated disclosure on a TP-Link Kasa camera resulted in two CVEs, a triage failure where the vendor described a vulnerability that doesn't exist in the reported payload, a beta patch that permanently bricked my test device, and a factory reset that doesn't clear previous owner data. The GPS finding (CVE-2026-13230) has been publicly documented on this device class since 2020. A single UDP packet ret…

[flagged]

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#23

Post by qurren » Sat, Jul 18, 2026, 6:24 AM UTC

holgerschurig wrote: post #21

qurren wrote: post #14

Earlier quoted context omitted.

HomeKit will take care of the VPN/remote access part, sure, but your devices still need to communicate with the HomeKit device, and that's usually over Wi-Fi, which puts the devices on the public internet, and carries the same security risk. There are various non-internet protocols for IoT devices, none of them good: * Zigbee: Requires some technical understanding to set up, devices randomly disconnect for hours even…

> Zigbee Requires no technical understanding. At least not more than e.g. a WIFI router. > devices randomly disconnect for hours even when they are 2ft from the coordinator, You present this like a fact. But it is at most an anecdote. I present you a different anecdote: I have ~30 zigbee devices, in two different houses (first a house with concrete floors and cellar and level 1..3) and now one old woodwork structure…

> Nowhere did I had even half an hour of disconnection.

Well my garage door opener sensor has been disconnected for two 30 minute gaps today and my plant humidity sensors go offline for 2 weeks at a time.

So yeah, it's not ready for prime time.

> LORA

No, let's not even go there. Tech nerd protocol here that's an awkward middle ground that creates even more problems. Average Joes aren't going to set that crap up.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#24

Post by yjftsjthsd-h » Sat, Jul 18, 2026, 6:32 AM UTC

qurren wrote: post #14

afavour wrote: post #13

Earlier quoted context omitted.

> It would be a no-go for non-techies. There are better solutions, like Apple’s HomeKit. I’m able to watch a camera that has no internet access because it passed through my Apple TV, which serves as a home hub. I didn’t have to set any of this up, it just works when you have the required hardware.

HomeKit will take care of the VPN/remote access part, sure, but your devices still need to communicate with the HomeKit device, and that's usually over Wi-Fi, which puts the devices on the public internet, and carries the same security risk. There are various non-internet protocols for IoT devices, none of them good: * Zigbee: Requires some technical understanding to set up, devices randomly disconnect for hours even…

> devices randomly disconnect for hours even when they are 2ft from the coordinator

I don't think that's normal. Like, to the point where I'm wondering if you have a bad opinion of the whole protocol because you got a faulty device.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#25

Post by lostmsu » Sat, Jul 18, 2026, 7:34 AM UTC

wolvoleo wrote: post #15

forestry wrote: post #7

Earlier quoted context omitted.

[flagged]

A random post on hacker news isn't going to make a dent in TP-Link's camera marketshare positive or negative. If the GP really has bad motives they wouldn't really accomplish anything with that. But I doubt they do. I use these cams myself too. They're ok if you limit their internet access. I limit all my TP-Link stuff anyway since they suddenly removed local access for their switched power plugs in an auto firmware…

> since they suddenly removed local access for their switched power plugs in an auto firmware update.

AFAIK it was because it was an unencrypted protocol and you can just manually turn it back on in device settings.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#26

Post by Namidairo » Sat, Jul 18, 2026, 7:42 AM UTC

copperx wrote: post #6

WarOnPrivacy wrote: post #5

Earlier quoted context omitted.

> Pretty much all cheap, Chinese-made hardware of this kind has intentional or unintentional security holes waiting to be exploited. Why single out bad Chinese coding? Bad US IoT coding has a longer history.

All of there IoT devices will be slop coded soon, and I wonder whether that will be an improvement or not. I bet that security will be better.

> All of there IoT devices will be slop coded soon

Soon?

I've already seen multiple of TP-Link's firmware engineers leave their LLM history public and indexed by search engines.

It's quite obviously them as well.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#27

Post by locknitpicker » Sat, Jul 18, 2026, 7:43 AM UTC

gruez wrote: post #3

The report seems obviously AI generated, so I can't be bothered to read in its entirety, but based on my quick skim, "leaked home GPS" makes it sound worse than it is. Unless you're dumb enough to set DMZ on this device, this won't be exposed to the internet, and if it's LAN only, don't you already know the location? Even for a remote attacker who somehow got LAN access remotely, they can probably deduce the location…

> Unless you're dumb enough to (...)

It sounds like you are blaming the user for providing data that a service can leak. That's like blaming a user for writing personal emails when faced with an email provider that leaks emails.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#28

Post by AndyMcConachie » Sat, Jul 18, 2026, 7:51 AM UTC

Why do people keep buying all this garbage and putting it in their homes?

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#29

Post by locknitpicker » Sat, Jul 18, 2026, 7:51 AM UTC

drnick1 wrote: post #4

This underscores the principle that IoT devices should not be allowed to communicate over the public Internet. Pretty much all cheap, Chinese-made hardware of this kind has intentional or unintentional security holes waiting to be exploited.

> This underscores the principle that IoT devices should not be allowed to communicate over the public Internet.

TP-Link is a prominent maker of network hardware, including home and mesh routers.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#30

Post by Arch-TK » Sat, Jul 18, 2026, 7:58 AM UTC

qurren wrote: post #23

holgerschurig wrote: post #21

Earlier quoted context omitted.

> Zigbee Requires no technical understanding. At least not more than e.g. a WIFI router. > devices randomly disconnect for hours even when they are 2ft from the coordinator, You present this like a fact. But it is at most an anecdote. I present you a different anecdote: I have ~30 zigbee devices, in two different houses (first a house with concrete floors and cellar and level 1..3) and now one old woodwork structure…

> Nowhere did I had even half an hour of disconnection. Well my garage door opener sensor has been disconnected for two 30 minute gaps today and my plant humidity sensors go offline for 2 weeks at a time. So yeah, it's not ready for prime time. > LORA No, let's not even go there. Tech nerd protocol here that's an awkward middle ground that creates even more problems. Average Joes aren't going to set that crap up.

Are you using a phoscon coordinator? ConBee 2 has a lot of firmware problems in my experience.

There are also some devices which advertise ZigBee compatibility but the manufacturers don't seem to test them against coordinators other than their own (and ConBee 2 seems to have the most problems in this regard).

The protocol is complex, they all are, implementing it correctly isn't a given, but I think the issues people have are more often a factor of how long a protocol has been in use than any fundamental aspect of it.

As soon as cheap hardware manufacturers get on board you get this problem.

Quality hardware works fine with ZigBee. It's by no means perfect technology, if you want that, use copper wires, but it doesn't work as badly as you claim if you are not unlucky with coordinators and devices.