CVE-2026-13230 is an information disclosure vulnerability in TP-Link Kasa EC70 v4 and EC71 v4 devices. The issue arises from the local discovery mechanism exposing sensitive geolocation data without requiring authentication. An attacker on the same local network can exploit this by sending crafted responses to retrieve this sensitive information. The vulnerability impacts confidentiality exclusively, with no reported effects on integrity or availability. No vendor advisory or patch information is currently available, and the remediation level is unspecified.

The vulnerability allows unauthorized local network attackers to obtain sensitive geolocation information from affected devices. This compromises the confidentiality of user location data but does not affect device integrity or availability. There is no evidence of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local network access to trusted devices to reduce exposure risk.