CVE-2025-26408

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the interface, full access to the device is possible. This enables an attacker to extract information, modify and debug the device's firmware. All known versions are affected.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-1191

Affected software

No affected versions have been published.

Timeline

Published
Feb 11, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-264096.8A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the interface, access toCVE-2025-26419.8A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.0. Affected by this issue isCVE-2025-264109.8The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovereCVE-2025-264118.8An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python CVE-2025-264126.8The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on tCVE-2025-264137.5Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer anCVE-2025-264169.8In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to rCVE-2025-264174.0In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storageCVE-2025-264187.8In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account toCVE-2025-264193.3In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. This could lead to localCVE-2025-26429.8A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.0. This affects an unknown part oCVE-2025-264204.4In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the incorrect permission du