CVE-2025-26409

Access to Bootloader and Shell Over Serial Interface

State: Published
Severity: 6.8 Medium
Published: Feb 11, 2025
Updated: Nov 3, 2025
Reserved: Feb 10, 2025

Description

A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the interface, access to the bootloader is possible, as well as a Linux login prompt. The bootloader access can be used to gain a root shell on the device. This issue is fixed in recent firmware versions BSP >= 6.4.1.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-1299 Missing Protection Mechanism for Alternate Hardware Interface
CWE-1191 On-Chip Debug and Test Interface With Improper Access Control

Affected Products

Product	Versions
Wattsense BridgeWattsense	before 6.4.1Affected

References

https://r.sec-consult.com/wattsensethird-party-advisory
https://support.wattsense.com/hc/en-150/articles/13366066529437-Release-Notesrelease-notes
http://seclists.org/fulldisclosure/2025/Feb/9

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.