CVE-2025-26409

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the interface, access to the bootloader is possible, as well as a Linux login prompt. The bootloader access can be used to gain a root shell on the device. This issue is fixed in recent firmware versions BSP >= 6.4.1.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1191 CWE-1299

Affected software

No affected versions have been published.

Timeline

Published: Feb 11, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-26419.8A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.0. Affected by this issue is CVE-2025-264109.8The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovere CVE-2025-264118.8An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python CVE-2025-264126.8The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on t CVE-2025-264137.5Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer an CVE-2025-264169.8In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to r CVE-2025-264174.0In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage CVE-2025-264187.8In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to CVE-2025-264193.3In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. This could lead to local CVE-2025-26429.8A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.0. This affects an unknown part o CVE-2025-264204.4In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the incorrect permission du CVE-2025-264214.0In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privi