CVE-2025-26410criticalCWE-798

CVE-2025-26410: falha crítica em Wattsense Bridge

Weak Hard-coded Credentials

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Wattsense Bridge

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.7%
The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password cracking attempts. The recovered credentials can be used to log into the device via the login shell that is exposed by the serial interface. The backdoor user has been removed in firmware BSP >= 6.4.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Wattsense · Wattsense Bridge
CVEs relacionadas — Wattsense Bridge

No mesmo produto, das mais perigosas para as menos.

CVE-2025-26411HIGHAuthenticated Arbitrary Python File Upload via Plugin ManagerEPSS 0.7%CVE-2025-26409MEDIUMAccess to Bootloader and Shell Over Serial InterfaceEPSS 0.3%CVE-2025-26408MEDIUMUnprotected JTAG InterfaceEPSS 0.3%