Hard-Coded Credentials in Wattsense Bridge Devices

CVE-2025-26410

What is CVE-2025-26410?

The firmware of Wattsense Bridge devices is compromised by the presence of hard-coded user and root credentials. These credentials can be easily exploited due to their recoverable nature through password cracking methods. Once retrieved, these credentials allow unauthorized access to the device via the exposed login shell on the serial interface. It is crucial to apply firmware updates, as the security flaw associated with the backdoor user account has been addressed in BSP versions 6.4.1 and later.

References