# CVE-2026-102370: TP-Link Kasa EC70 and EC71 v4 debug interface and bootloader bypass

Source: https://junglewise.ai/threats/cve-2026-102370-kasa-ec70-v4-and-ec71-v4-do-not-logically-disable-the-production  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-102370 · Severity: info · Published 2026-10-01

The Kasa EC70 and EC71 v4 smart cameras have an accessible debug interface and unlocked bootloader that were only physically disconnected during manufacturing. An attacker with physical access to the device can restore these connections, interrupt the boot process, and gain unauthenticated root-level access. This allows complete compromise of the camera's confidentiality, integrity, and availability.

Technologies: [TP-Link Kasa EC70](https://junglewise.ai/threats/technologies/kasa-ec70), [TP-Link Kasa EC71](https://junglewise.ai/threats/technologies/kasa-ec71). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-102370 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102370 being exploited in the wild.

**How severe is CVE-2026-102370?** Informational severity, published 1 October 2026.

**Which products and versions are affected?** TP-Link Kasa EC70 v4; TP-Link Kasa EC71 v4.

**Is there a fix for CVE-2026-102370?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102370 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2026-102370?** Check whether you run TP-Link Kasa EC70 or TP-Link Kasa EC71 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from debug traces and bootloader controls that are not logically disabled at the firmware or chip level, only physically severed during manufacturing. An attacker with physical device access can restore the severed debug connection, interrupt the boot sequence, and manipulate boot parameters to trigger a non-standard initialization path that exposes an unauthenticated root shell. This requires device disassembly and deliberate hardware modification.

## Affected products

- TP-Link Kasa EC70 v4
- TP-Link Kasa EC71 v4

## Timeline

- 2026-10-01: disclosed

## References

- [https://www.tp-link.com/us/support/download/ec70/v4/](https://www.tp-link.com/us/support/download/ec70/v4/)
- [https://www.tp-link.com/us/support/download/ec71/v4/](https://www.tp-link.com/us/support/download/ec71/v4/)

## Related threats

- [TP-Link Kasa EC70 and EC71 hard-coded cryptographic key](https://junglewise.ai/threats/cve-2026-9770-tp-link-kasa-ec70-and-ec71-hard-coded-cryptographic-key)
- [TP-Link Kasa EC70 and EC71 information disclosure in local discovery](https://junglewise.ai/threats/cve-2026-13230-tp-link-kasa-ec70-and-ec71-information-disclosure-in-local)