CVE-2025-26411highCWE-434

CVE-2025-26411: falha de alta gravidade em Wattsense Bridge

Authenticated Arbitrary Python File Upload via Plugin Manager

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Wattsense Bridge

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.7%
An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python files to the device. This enables an attacker to gain remote root access to the device. An attacker needs a valid user account on the Wattsense web interface to be able to conduct this attack. This issue is fixed in recent firmware versions BSP >= 6.1.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Wattsense · Wattsense Bridge
CVEs relacionadas — Wattsense Bridge

No mesmo produto, das mais perigosas para as menos.

CVE-2025-26410CRITICALWeak Hard-coded CredentialsEPSS 0.7%CVE-2025-26409MEDIUMAccess to Bootloader and Shell Over Serial InterfaceEPSS 0.3%CVE-2025-26408MEDIUMUnprotected JTAG InterfaceEPSS 0.3%