CVE-2025-26410

Summary

CVE-2025-26410 is a vulnerability affecting all Wattsense Bridge devices. The issue lies in the use of hard-coded, identical user and root credentials in the firmware. These credentials can be recovered through password cracking attempts, granting unauthorized access to the device. The login shell exposed via the serial interface allows the attacker to log in using these credentials. However, the backdoor user has been removed in firmware BSP version 6.4.1. This vulnerability poses a significant risk, particularly for devices not updated to the latest firmware version.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.