CVE-2025-26410

CRITICAL

Wattsense Bridge < 6.4.1 - Use of Hard-coded Credentials via Serial Interface

Title source: llm

Description

The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password cracking attempts. The recovered credentials can be used to log into the device via the login shell that is exposed by the serial interface. The backdoor user has been removed in firmware BSP >= 6.4.1.

References (3)

Core 3

Core References

Various Sources third-party-advisory

https://r.sec-consult.com/wattsense

Mailing List

http://seclists.org/fulldisclosure/2025/Feb/9

Various Sources release-notes

https://support.wattsense.com/hc/en-150/articles/13366066529437-Release-Notes

Scores

CVSS v3 9.8

EPSS 0.0066

EPSS Percentile 46.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-798

Status published

Products (1)

Wattsense/Wattsense Bridge < 6.4.1

Published Feb 11, 2025

Tracked Since Feb 18, 2026