A six-year-old security flaw in TP-Link Kasa smart cameras exposed users' home GPS coordinates through an unauthenticated UDP port. Discovered by an independent IoT security researcher, the vulnerability allowed the devices to continuously broadcast sensitive location data without requiring any authentication.