CVE-2026-102370 Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC71
Physical access allows attackers to restore debug interfaces and obtain an unauthenticated root shell on TP-Link Kasa cameras.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-102370?
CVE-2026-102370 is a medium-severity authentication bypass vulnerability in TP-Link Systems Inc. Kasa EC70 V4, published on 1 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader. Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot process, and manipulate boot parameters to enter a non-standard initialization path that exposes an unauthenticated root shell during startup.
Successful exploitation may allow an attacker with physical access to obtain root-level command access during device startup, resulting in loss of confidentiality, integrity, and availability for the affected device. Exploitation requires device disassembly, restoration of the severed debug connection, and manipulation of the boot process.
Weakness: CWE-1191
Which versions are affected by CVE-2026-102370?
How do I fix CVE-2026-102370?
No fix has been published for CVE-2026-102370 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-102370 being exploited?
There is no known exploitation of CVE-2026-102370 in the wild and no public exploit code.
Sources
Also known as GHSA-6p9x-mrgq-g8cr.