This vulnerability (CVE-2026-9770) involves the use of a static cryptographic private key embedded in the firmware of TP-Link Kasa EC71 v4 and EC70 v4 devices. The key is stored in a read-only filesystem and is shared across devices, making it accessible to attackers who can obtain the firmware image. The presence of this hard-coded key violates secure cryptographic practices (CWE-321) and allows attackers on the same network to leverage the key to compromise encrypted communications in the device's web management service. The CVSS 4.0 score is 8.6, reflecting high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity.

An unauthenticated attacker on the same network can extract the hard-coded cryptographic key from the firmware image and use it to decrypt encrypted communications or perform man-in-the-middle attacks against the device's web management service. This compromises the confidentiality and integrity of the device's management traffic, potentially exposing sensitive information or allowing manipulation of device settings.

No official patch or remediation has been disclosed by the vendor as of the publication date. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device's management interface to trusted users only and avoid exposing the device to untrusted networks.