CVE-2025-10991
BaseFortify
Publication date: 2025-09-30
Last updated on: 2025-10-02
Assigner: TPLink
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tp-link | tapo_d230s1 | v1.20 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the TP-Link Tapo D230S1 device (version V1.20 before firmware 1.2.2 Build 20250907). An attacker with physical access to the device can connect to the UART port and gain root access, allowing full control over the device as the root user. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability allows an attacker with physical access to gain root-level control over the device, potentially compromising its confidentiality, integrity, and availability. This means the attacker can fully control the device, which could lead to unauthorized access, manipulation, or disruption of device functions. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability requires physical access to the device and involves connecting to the UART port to gain root access. Detection on the network or system remotely is not applicable since the attack vector is physical. There are no specific commands provided to detect this vulnerability remotely or on the network.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the TP-Link Tapo D230S1 device firmware to version 1.2.2 Build 20250907 or later, as this firmware update addresses and fixes the issue. Users should follow the official update instructions provided by TP-Link to ensure the device is no longer vulnerable. [1]