CVE-2025-10991
Root Access via UART
- State
- Published
- Severity
- 7.0 High
- Published
- Sep 30, 2025
- Updated
- Sep 30, 2025
- Reserved
- Sep 25, 2025
Description
The attacker may obtain root access by connecting to the UART port and this vulnerability requires the attacker to have the physical access to the device.
This issue affects Tapo D230S1 V1.20: before 1.2.2 Build 20250907.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.0 High | CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | TPLink |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
Tapo D230S1 V1.20TP-Link Systems Inc. |
|
References
- https://www.tp-link.com/en/support/faq/4693/vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.