https://vulnerability.circl.lu/comments/feed 2026-09-23T14:47:33.100739+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent comments. https://vulnerability.circl.lu/comment/3f4a59e6-61ef-4b4c-bb57-07f721f9db14 2026-09-23T14:47:33.105618+00:00 Cédric Bonhomme https://vulnerability.circl.lu/user/cedric There is an interesting connection between this vulnerability and CVE-2026-13230, which affects the same TP-Link Kasa EC70/EC71 devices. Recent research indicates that LG TVs send UDP/9999 discovery broadcasts approximately every 25 seconds. UDP/9999 is also used by the Kasa local discovery mechanism affected by CVE-2026-13230, which can disclose precise GPS coordinates without authentication. This suggests that, on a local network containing both an LG TV and an unpatched Kasa EC70/EC71, the TV's periodic discovery traffic may trigger the vulnerable Kasa discovery response and expose the camera's stored geolocation information. The two issues are distinct: CVE-2026-9770 concerns a hardcoded cryptographic private key, while CVE-2026-13230 concerns sensitive information disclosure through the local discovery mechanism. However, the shared UDP/9999 discovery traffic is worth investigating as a potential interaction between the two vulnerabilities. Reference: [https://github.com/BadChemical/IoT-Vulnerability-Research-Public/blob/main/TP-Link_Kasa_EC71/Kasa_EC71.md](https://github.com/BadChemical/IoT-Vulnerability-Research-Public/blob/main/TP-Link_Kasa_EC71/Kasa_EC71.md) 2026-09-08T21:30:10.830811+00:00