What’s Vulnerable › Vulnerabilities
CVE-2025-10991: Root Access via UART
- Severity: high (CVSS 7.0 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-09-30 · updated 2026-06-17
- Weakness: CWE-306
Description
The attacker may obtain root access by connecting to the UART port and this vulnerability requires the attacker to have the physical access to the device. This issue affects Tapo D230S1 V1.20: before 1.2.2 Build 20250907.
Affected products
- TP-Link Systems Inc. Tapo D230S1 V1.20: before 1.2.2 Build 20250907 — fixed in 1.2.2 Build 20250907
How to fix
Upgrade to a fixed version: TP-Link Systems Inc. Tapo D230S1 V1.20 1.2.2 Build 20250907. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-10991 or the next vulnerability affects your stack