TP-Link Kasa cameras leaked home GPS via unauthenticated UDP - for six years

A vulnerability researcher documents six years of unauthenticated UDP replies from TP-Link Kasa EC71 cameras that returned the device's GPS coordinates on request - a textbook IoT trust-boundary failure.

The fact

An independent researcher published a technical write-up (BadChemical/IoT-Vulnerability-Research-Public) documenting that TP-Link Kasa EC71 cameras responded to unauthenticated UDP packets with the device's GPS coordinates - a discovery that dates the exposure back roughly six years across the product line.

Our read

The interesting layer isn't that a consumer camera had a bug. It's which bug: an unauthenticated UDP endpoint returning geolocation is the kind of design decision that only survives when nobody in the vendor chain owns the trust boundary. Six years of firmware releases went past it. That's the systemic issue - vendor SDLC on cheap IoT is still treating internet-exposed services as an implementation detail rather than a threat surface.

For anyone building agentic tooling that talks to home devices (a fast-growing category), this is a reminder: the assumed-safe local network is not, in fact, safe. If your agent trusts LAN responses the way TP-Link trusted UDP requests, you have the same class of bug in a fresher wrapper.

À surveiller

TP-Link's patch cadence and, more telling, whether it retro-fixes older EC71 units still in the field. Also: whether the FCC or FTC pick this up - six years is the kind of timeline that draws regulatory attention post-CISA-secure-by-design push.