A Factory Reset Left the Previous Owner’s GPS Coordinates on a Kasa Camera

A factory reset that leaves the previous owner’s location behind is a broken reset. If you sell a device or send it back, the next person should not be able to retrieve your coordinates from setup mode.

A July 2026 test of the Kasa EC71, an indoor pan-and-tilt camera, documents exactly that failure. Security researcher Christopher Childress reports that a tested unit running firmware 2.3.26 retained the former owner’s precise GPS coordinates after a factory reset and exposed them without authentication.

The network path was straightforward. In setup access-point mode, Childress sent a standard get_sysinfo UDP request to port 9999. The response included the previous owner’s coordinates alongside device identifiers. Getting that response required local network access; it required no account, prior pairing, or physical access to the camera’s internals. A secondhand buyer could power up an apparently reset device, join its setup network, and receive location data belonging to somebody else. Childress documents the test and reset residue in his technical advisory.

TP-Link confirms the underlying unauthenticated geolocation flaw in its security advisory. The reset path comes from Childress’s experiment. TP-Link’s advisory, last updated July 15, 2026, says the local discovery mechanism on EC70 v4 and EC71 v4 exposed geolocation information without authentication. The vendor assigned CVE-2026-13230, rated it 5.3 Medium under CVSS 4.0, and reported no integrity or availability impact. The listed fix is 2.4.1 Build 20260621 rel.76536. The NVD record repeats TP-Link’s affected-version boundary while noting that NVD enrichment was still pending when I checked it.

The same unit also retained account material. Childress used a CH341A programmer to read the SPI flash directly and parsed the writable JFFS2 filesystem. He reports finding a plaintext TP-Link ID email address and an unsalted MD5 password hash from the former owner. This recovery path required physical extraction. The GPS path needed only a connection to the camera’s temporary setup network. Blurring them together would make the easy attack sound harder and the hardware attack sound remote.

A Medium score is defensible for a local, read-only network flaw. It misses the practical conflict. Coordinates can identify a residence, and the person exposed is no longer the person controlling the device. Reset is supposed to end that relationship. Here, the camera entered a state intended for its next owner while continuing to answer with data from the previous one.

Device teams should test reset as a destructive security transition. After resetting a unit, inspect every writable partition for credentials, location values, identifiers, and tokens. Repeat the unauthenticated discovery calls available during setup and verify that no former-owner state comes back. A successful re-pairing screen proves that onboarding restarted. It says nothing about what survived in flash.

The evidence remains narrow. Childress tested an EC71 on firmware 2.3.26, and the public sources do not establish how many devices still run affected firmware or whether other camera families retain equivalent data. TP-Link recommends updating affected devices and lists the patched version in its advisory. Before a team declares reset complete, it needs evidence from the storage and setup states that the next owner will actually receive.

What I'm building

Delegate tasks. Get software.

Give Vroni a GitHub issue, bug report, spec, or rough idea. It reads the repo, plans the change, writes code, runs checks, and works toward a review-ready pull request.

Take a look at vroni.com