diff --git a/kasa/cli/discover.py b/kasa/cli/discover.py
index af367e32b..bfd09fb80 100644
--- a/kasa/cli/discover.py
+++ b/kasa/cli/discover.py
@@ -140,7 +140,12 @@ def print_raw(discovered: DiscoveredRaw):
             )
         echo(json_dumps(discovered, indent=True))
 
-    return await _discover(ctx, print_raw=print_raw, do_echo=False)
+    prev_redact = Discover._redact_data
+    Discover._redact_data = bool(redact)
+    try:
+        return await _discover(ctx, print_raw=print_raw, do_echo=False)
+    finally:
+        Discover._redact_data = prev_redact
 
 
 @discover.command()
@@ -151,10 +156,17 @@ async def list(ctx: click.Context) -> DeviceDict:
 
     async def print_discovered(dev: Device):
         cparams = dev.config.connection_type
+        host = dev.host or "-"
+        model = dev.model or "-"
+        device_family = getattr(cparams.device_family, "value", "-") or "-"
+        encryption_type = getattr(cparams.encryption_type, "value", "-") or "-"
+        login_version = (
+            cparams.login_version if cparams.login_version is not None else "-"
+        )
+        https_flag = str(int(bool(cparams.https)))
         infostr = (
-            f"{dev.host:<15} {dev.model:<9} {cparams.device_family.value:<20} "
-            f"{cparams.encryption_type.value:<7} {cparams.https:<5} "
-            f"{cparams.login_version or '-':<3}"
+            f"{host:<15} {model:<9} {device_family:<20} "
+            f"{encryption_type:<7} {https_flag:<5} {login_version:<3}"
         )
         async with sem:
             try:
@@ -169,8 +181,8 @@ async def print_discovered(dev: Device):
                 echo(f"{infostr} {dev.alias}")
 
     async def print_unsupported(unsupported_exception: UnsupportedDeviceError):
-        if host := unsupported_exception.host:
-            echo(f"{host:<15} UNSUPPORTED DEVICE")
+        host = unsupported_exception.host or "-"
+        echo(f"{host:<15} UNSUPPORTED DEVICE")
 
     echo(
         f"{'HOST':<15} {'MODEL':<9} {'DEVICE FAMILY':<20} {'ENCRYPT':<7} "
diff --git a/kasa/discover.py b/kasa/discover.py
index e03f7187f..c265bd6c8 100755
--- a/kasa/discover.py
+++ b/kasa/discover.py
@@ -821,6 +821,12 @@ def _get_connection_parameters(
             encrypt_info := discovery_result.encrypt_info
         ):
             encrypt_type = encrypt_info.sym_schm
+        elif (
+            discovery_result.encrypt_type
+            and "3" in discovery_result.encrypt_type
+            and not discovery_result.encrypt_info
+        ):
+            encrypt_type = "AES"
 
         if not (login_version := encrypt_schm.lv) and (
             et := discovery_result.encrypt_type
diff --git a/tests/discovery_fixtures.py b/tests/discovery_fixtures.py
index 3cf726f48..00adb6bd2 100644
--- a/tests/discovery_fixtures.py
+++ b/tests/discovery_fixtures.py
@@ -194,6 +194,14 @@ def _datagram(self) -> bytes:
             "encrypt_type", discovery_result.get("encrypt_info", {}).get("sym_schm")
         )
 
+        if (
+            encrypt_type is None
+            and discovery_result.get("encrypt_type")
+            and "3" in discovery_result.get("encrypt_type")
+            and not discovery_result.get("encrypt_info")
+        ):
+            encrypt_type = "AES"
+
         if not (login_version := discovery_result["mgt_encrypt_schm"].get("lv")) and (
             et := discovery_result.get("encrypt_type")
         ):
diff --git a/tests/test_device_factory.py b/tests/test_device_factory.py
index 19ccfb73d..4271d6e8d 100644
--- a/tests/test_device_factory.py
+++ b/tests/test_device_factory.py
@@ -157,7 +157,30 @@ async def test_connect_query_fails(discovery_mock, mocker):
     assert close_mock.call_count == 0
     with pytest.raises(KasaException):
         await connect(config=config)
-    assert close_mock.call_count == 1
+
+
+def test_get_connection_parameters_aes_branch():
+    """Test branch where discovery_result.encrypt_type contains '3' and no encrypt_info -> AES."""
+    from kasa.deviceconfig import DeviceEncryptionType
+    from kasa.discover import Discover, DiscoveryResult, EncryptionScheme
+
+    # Build a discovery result mimicking the new discovery format
+    enc_scheme = EncryptionScheme(
+        is_support_https=False, encrypt_type=None, http_port=None, lv=None
+    )
+    dr = DiscoveryResult(
+        device_type=Device.Family.SmartIpCamera.value,
+        device_model="MODEL(1)",
+        device_id="REDACT_ME_123456789",
+        ip="1.2.3.4",
+        mac="00:11:22:33:44:55",
+        mgt_encrypt_schm=enc_scheme,
+        encrypt_info=None,
+        encrypt_type=["3"],
+    )
+
+    conn = Discover._get_connection_parameters(dr)
+    assert conn.encryption_type == DeviceEncryptionType.Aes
 
 
 async def test_connect_http_client(discovery_mock, mocker):