---
id: CVE-2026-102370
title: "Kasa EC70 v4\nand EC71 v4 do not logically disable the production debug interface at the\nfirmware or chip level and do not lock the bootloader.\_ Although the debug traces are physically\nsevered during manufacturing, an attacker with physi…"
summary: "Kasa EC70 v4\nand EC71 v4 do not logically disable the production debug interface at the\nfirmware or chip level and do not lock the bootloader.\_ Although the debug traces are physically\nsevered during manufacturing, an attacker with physi…"
severity: medium
cvss: 5.4
cvssVector: 'CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-1191
vendor: TP-Link Systems Inc.
product: Kasa EC70 V4
affected:
  - kasa_ec70_v4 < 2.4.3 Build 20260902 rel.4511
  - kasa_ec71_v4 < 2.4.3 Build 20260902 rel.4511
published: '2026-10-01'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T18:47:49.947'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102370'
references:
  - url: >-
      https://www.tp-link.com/us/support/download/ec70/v4/#Firmware-Release-Notes
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: >-
      https://www.tp-link.com/us/support/download/ec71/v4/#Firmware-Release-Notes
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/us/support/faq/5324/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
tags:
  - nvd
  - cve.org
epss: 0.00179
epssPercentile: 0.07388
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-01T21:01:19.841347Z'
cvssSource: cna
ingestedAt: '2026-10-01T21:00:32.269Z'
---

## Overview

Kasa EC70 v4
and EC71 v4 do not logically disable the production debug interface at the
firmware or chip level and do not lock the bootloader.  Although the debug traces are physically
severed during manufacturing, an attacker with physical access can restore the
connection, interrupt the boot process, and manipulate boot parameters to enter
a non-standard initialization path that exposes an unauthenticated root shell
during startup.









Successful exploitation may allow an
attacker with physical access to obtain root-level command access during device
startup, resulting in loss of confidentiality, integrity, and availability for
the affected device. Exploitation requires device disassembly, restoration of
the severed debug connection, and manipulation of the boot process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.