TP-LINK KASA CAMERAS LEAKED HOME GPS FOR 6 YEARS

The vulnerability affected Kasa EC71 cameras and potentially other models in the lineup. Researchers discovered the cameras sent precise location data through UDP without authentication, allowing attackers to intercept and determine where devices were installed. The flaw persisted from the cameras' initial release through at least 2024, suggesting a significant gap in TP-Link's security review process. UDP packets can be captured by anyone monitoring network traffic, making the exposure particularly severe for home security devices designed to protect residences. TP-Link has not yet issued a public statement regarding the vulnerability. Affected users should update firmware immediately once patches become available. This incident highlights ongoing security concerns with IoT devices, where manufacturers frequently prioritize connectivity over baseline encryption and authentication measures. The research was shared publicly on GitHub, allowing users to assess their own exposure.