{"schema":"threatline.record/2","record":{"id":"CVE-2026-102370","aliases":[],"summary":"Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC71","details":"Kasa EC70 v4\nand EC71 v4 do not logically disable the production debug interface at the\nfirmware or chip level and do not lock the bootloader.  Although the debug traces are physically\nsevered during manufacturing, an attacker with physical access can restore the\nconnection, interrupt the boot process, and manipulate boot parameters to enter\na non-standard initialization path that exposes an unauthenticated root shell\nduring startup.\n\n\n\n\n\n\n\n\n\nSuccessful exploitation may allow an\nattacker with physical access to obtain root-level command access during device\nstartup, resulting in loss of confidentiality, integrity, and availability for\nthe affected device. Exploitation requires device disassembly, restoration of\nthe severed debug connection, and manipulation of the boot process.","categories":["Network & edge"],"product":"Kasa EC70 V4","vendor":"TP-Link Systems Inc.","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102370","source_modified_at":"2026-10-01T21:01:44.613Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Kasa EC70 V4","vendor":"TP-Link Systems Inc.","versions":[{"status":"affected","version":"0","lessThan":"2.4.3 Build 20260902 rel.4511","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102370","source_modified_at":"2026-10-01T21:01:44.613Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Kasa EC71 V4","vendor":"TP-Link Systems Inc.","versions":[{"status":"affected","version":"0","lessThan":"2.4.3 Build 20260902 rel.4511","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102370","source_modified_at":"2026-10-01T21:01:44.613Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Kasa EC70 V4","ecosystem":null},"version":"2.4.3 Build 20260902 rel.4511","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102370","source_modified_at":"2026-10-01T21:01:44.613Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Kasa EC71 V4","ecosystem":null},"version":"2.4.3 Build 20260902 rel.4511","basis":"first unaffected version stated in the CVE record"}],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00179,"percentile":0.07072,"score_date":"2026-10-23"},"published_at":"2026-10-01T20:47:30.211Z","modified_at":"2026-10-01T21:01:44.613Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-102370","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-01T21:01:44.613Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102370","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.tp-link.com/us/support/download/ec71/v4/#Firmware-Release-Notes","tags":["patch"]},{"source":"CVE List","url":"https://www.tp-link.com/us/support/download/ec70/v4/#Firmware-Release-Notes","tags":["patch"]},{"source":"CVE List","url":"https://www.tp-link.com/us/support/faq/5324/","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-01T21:01:19.841347Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"vendor and product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-01T21:01:44.613Z","content_hash":"01168dc0bd685feaf16ce4c0a745658c3c9ebcdb2c288cf3f708c0bdb64bb2cc"}}