Skip to content
Fencer Vulns
medium 5.4

CVE-2026-102370 json

Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC71

published 2026-10-01 38 d ago modified 2026-10-02 37 d ago also EUVD-2026-91060

cvss
5.4
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader.  Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot process, and manipulate boot parameters to enter a non-standard initialization path that exposes an unauthenticated root shell during startup.

Successful exploitation may allow an attacker with physical access to obtain root-level command access during device startup, resulting in loss of confidentiality, integrity, and availability for the affected device. Exploitation requires device disassembly, restoration of the severed debug connection, and manipulation of the boot process.

Patch / fix

  • TP-Link Systems Inc. Kasa EC70 V4 2.4.3 Build 20260902 rel.4511
  • TP-Link Systems Inc. Kasa EC71 V4 2.4.3 Build 20260902 rel.4511

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
38 d ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 5.4 CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 5.4 CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • TP-Link Systems Inc. Kasa EC70 V4
  • TP-Link Systems Inc. Kasa EC71 V4

Classification

Weakness
  • CWE-1191 On-Chip Debug and Test Interface With Improper Access Control

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.