Kasa EC70/EC71 EUVD-2026-91060

Exploitation requires full physical possession and disassembly of the device, plus hardware-level work: the manufacturing-severed debug traces must be physically restored (resoldered/bridged) because the production debug interface is not logically disabled at firmware or chip level and the bootloader is not locked. The attacker must then interrupt the boot process over that restored interface and manipulate boot parameters to reach a non-standard initialization path that exposes an unauthenticated root shell. Limiting factors: no remote or network path exists (AV:P), no over-the-air or software-only exploitation is possible, and success depends on hardware rework skill and tools - these constraints sharply reduce realistic risk outside of untrusted-physical-custody threat models.

This is a genuinely low-to-moderate real-world risk despite full confidentiality/integrity/availability impact, because the attack vector is physical and gated behind demanding preconditions. The CVSS 4.0 vector (AV:P/AC:L/AT:P/PR:N/UI:N) correctly reflects that no credentials or user interaction are needed once the attacker has the device in hand, but AV:P plus AT:P (a specific attack requirement) means the attacker must physically possess, disassemble, and modify the hardware - restoring debug traces that were deliberately severed during manufacturing. There is no EPSS score provided, no CISA KEV listing, and no public exploit identified, so there is no evidence of scalable or remote exploitation; the 5.4 base score is consistent with a high-impact-but-hard-to-reach local hardware flaw rather than a mass-exploitable network vulnerability. The signals are internally consistent (no conflict between vector and description - both indicate physical/local access), so this should be triaged as a hardware supply-chain / device-tampering concern rather than a fleet-wide emergency. Priority rises only for threat models involving untrusted physical custody (resale, loss, theft, evil-maid, or hostile lab access).

An attacker who gains temporary physical custody of a Kasa EC70 v4 or EC71 v4 device (e.g., a returned/resold unit, or a device accessed in a hostile environment) disassembles it, resolders or bridges the manufacturing-severed debug traces, and interrupts the boot sequence over the restored interface. By manipulating boot parameters they force a non-standard initialization path that drops an unauthenticated root shell during startup, giving full control of the device. No public exploit code is identified at time of analysis, so this currently requires attacker-developed hardware tooling and know-how.