{"id":"CVE-2026-102370","published":"2026-10-01T21:17:17.703","lastModified":"2026-10-02T18:47:49.947","description":"Kasa EC70 v4\nand EC71 v4 do not logically disable the production debug interface at the\nfirmware or chip level and do not lock the bootloader.  Although the debug traces are physically\nsevered during manufacturing, an attacker with physical access can restore the\nconnection, interrupt the boot process, and manipulate boot parameters to enter\na non-standard initialization path that exposes an unauthenticated root shell\nduring startup.\n\n\n\n\n\n\n\n\n\nSuccessful exploitation may allow an\nattacker with physical access to obtain root-level command access during device\nstartup, resulting in loss of confidentiality, integrity, and availability for\nthe affected device. Exploitation requires device disassembly, restoration of\nthe severed debug connection, and manipulation of the boot process.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-1191"],"vendors":[],"products":[],"references":[{"url":"https://www.tp-link.com/us/support/download/ec70/v4/#Firmware-Release-Notes","tags":[]},{"url":"https://www.tp-link.com/us/support/download/ec71/v4/#Firmware-Release-Notes","tags":[]},{"url":"https://www.tp-link.com/us/support/faq/5324/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}