For Six Years, a TP-Link Camera Quietly Broadcast Where You Live

You buy a security camera to protect your home. What if it was quietly telling the neighborhood exactly where that home is? That is precisely what happened with Kasa, TP-Link’s smart home camera line. The kicker: the flaw sat undiscovered for nearly six years. It is a near-perfect case study in everything wrong with IoT security today.

One honest note up front. This is not a story blowing up on Hacker News this week. It is a structural, symbolic example of how consumer IoT keeps failing at the fundamentals. So this piece leans on the technical mechanics and what they imply, not on live community reaction.

Why Does a Camera Know Where You Live?

Start with the part that sounds strange. Why would a security camera hold your GPS coordinates at all?

Most smart home cameras use location during setup. It powers the weather widget, flips on night mode at the right sunset time, and sets the correct time zone. When you configure the camera through the phone app, an approximate location gets stored on the device.

None of that is unusual. The problem is that this sensitive detail was left where anyone could pull it out.

The Whole Bug Is “Unauthenticated UDP”

The vulnerability boils down to one sentence. A single UDP request that required no authentication would make the camera hand over its location.

If the jargon is unfamiliar, here is the plain version. UDP is one of the ways devices trade data over a network. Think of it as mailing a letter without waiting for a delivery confirmation. It is fast and lightweight, but the checks are loose.

Pair that with no authentication and it gets ugly. Normally the device should ask “Who are you, and are you allowed in?” before answering. That gate simply did not exist. Anyone on the same network, or meeting a few basic conditions, could ask the camera “Where are you?” with no password and no account. The camera happily replied with its coordinates.

The Weight of Six Years

The most damning detail is the timeline: six years.

The flaw is bad. The fact that nobody caught it for six years is worse. For all that time, cameras in countless homes may have been quietly leaking their coordinates.

This is the chronic IoT disease. We stare at our phones and laptops every day, and update prompts nag us constantly. But a camera bolted to a ceiling corner is easy to forget the moment it is installed. “It still works, so it’s probably fine” is exactly how six years happen.

Why a Location Leak Is Especially Dangerous

Some will shrug. “The video didn’t leak. Is a little location data really a big deal?”

Location is far more sensitive than it looks. Exposing your home coordinates means exposing where you live. Combine that with other signals and the risk multiplies.

Whether a camera is online can hint at whether someone is home. Add a precise address to that, and you have the raw material for a physical crime. This is the point where a digital flaw crosses into the real world. A leak that threatens your offline safety is arguably scarier than one that exposes footage online.

What You Can Do Right Now

So what should a user actually do? A few habits cover most of the risk.

First, update your firmware. Flaws like this almost always get closed by a manufacturer patch. Make a habit of checking the update tab in the app now and then.

Second, put your IoT devices on a separate network. Use your router’s guest Wi-Fi to keep cameras off the main network, so that if one device is compromised, the blast radius stays small.

Third, when buying new hardware, check how long the vendor promises security updates. The cheap device that gets abandoned is the most dangerous one you can own.

The gadget you bought to guard your home ends up exposing it. That irony is the current state of IoT security. In exchange for convenience, how many doors are we quietly leaving open? Tonight might be a good time to check on the smart devices humming away in the corners of your home.