TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

Post by arjie » Sat, Jul 18, 2026, 8:32 AM UTC

locknitpicker wrote: post #27

gruez wrote: post #3

The report seems obviously AI generated, so I can't be bothered to read in its entirety, but based on my quick skim, "leaked home GPS" makes it sound worse than it is. Unless you're dumb enough to set DMZ on this device, this won't be exposed to the internet, and if it's LAN only, don't you already know the location? Even for a remote attacker who somehow got LAN access remotely, they can probably deduce the location…

> Unless you're dumb enough to (...) It sounds like you are blaming the user for providing data that a service can leak. That's like blaming a user for writing personal emails when faced with an email provider that leaks emails.

Post by maccard » Sat, Jul 18, 2026, 9:01 AM UTC

forestry wrote: post #8

WarOnPrivacy wrote: post #5

Earlier quoted context omitted.

> Pretty much all cheap, Chinese-made hardware of this kind has intentional or unintentional security holes waiting to be exploited. Why single out bad Chinese coding? Bad US IoT coding has a longer history.

There’s bad, and then there’s egregious .

Post by user2722 » Sat, Jul 18, 2026, 9:18 AM UTC

BadChemical wrote: post #2

Six months of coordinated disclosure on a TP-Link Kasa camera resulted in two CVEs, a triage failure where the vendor described a vulnerability that doesn't exist in the reported payload, a beta patch that permanently bricked my test device, and a factory reset that doesn't clear previous owner data. The GPS finding (CVE-2026-13230) has been publicly documented on this device class since 2020. A single UDP packet ret…

Post by robocat » Sat, Jul 18, 2026, 9:57 AM UTC

qurren wrote: post #23

holgerschurig wrote: post #21

Earlier quoted context omitted.

> Zigbee Requires no technical understanding. At least not more than e.g. a WIFI router. > devices randomly disconnect for hours even when they are 2ft from the coordinator, You present this like a fact. But it is at most an anecdote. I present you a different anecdote: I have ~30 zigbee devices, in two different houses (first a house with concrete floors and cellar and level 1..3) and now one old woodwork structure…

> Nowhere did I had even half an hour of disconnection. Well my garage door opener sensor has been disconnected for two 30 minute gaps today and my plant humidity sensors go offline for 2 weeks at a time. So yeah, it's not ready for prime time. > LORA No, let's not even go there. Tech nerd protocol here that's an awkward middle ground that creates even more problems. Average Joes aren't going to set that crap up.

Post by nubinetwork » Sat, Jul 18, 2026, 10:03 AM UTC