and EC71 v4 do not logically disable the production debug interface at the
firmware or chip level and do not lock the bootloader. Although the debug traces are physically
severed during manufacturing, an attacker with physical access can restore the
connection, interrupt the boot process, and manipulate boot parameters to enter
a non-standard initialization path that exposes an unauthenticated root shell
during startup.
Successful exploitation may allow an
attacker with physical access to obtain root-level command access during device
startup, resulting in loss of confidentiality, integrity, and availability for
the affected device. Exploitation requires device disassembly, restoration of
the severed debug connection, and manipulation of the boot process.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | Kasa EC70 V4 | unaffected |
|
||||||
| TP-Link Systems Inc. | Kasa EC71 V4 | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 01 Oct 2026 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 01 Oct 2026 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader. Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot process, and manipulate boot parameters to enter a non-standard initialization path that exposes an unauthenticated root shell during startup. Successful exploitation may allow an attacker with physical access to obtain root-level command access during device startup, resulting in loss of confidentiality, integrity, and availability for the affected device. Exploitation requires device disassembly, restoration of the severed debug connection, and manipulation of the boot process. | |
| Title | Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC71 | |
| Weaknesses | CWE-1191 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: TPLink
Published:
Updated: 2026-10-01T21:01:44.613Z
Reserved: 2026-09-28T23:32:02.361Z
Link: CVE-2026-102370
Vulnrichment
Updated: 2026-10-01T21:01:41.059Z
NVD
Status : Received
Published: 2026-10-01T21:17:17.703
Modified: 2026-10-01T22:17:00.393
Link: CVE-2026-102370
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-1191
On-Chip Debug and Test Interface With Improper Access Control