CVE-2025-26410 - Vulnerability Details - OpenCVE

The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password cracking attempts. The recovered credentials can be used to log into the device via the login shell that is exposed by the serial interface. The backdoor user has been removed in firmware BSP >= 6.4.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://r.sec-consult.com/wattsense
https://support.wattsense.com/hc/en-150/articles/13366066529437-Release-Notes

History

Tue, 18 Mar 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Tue, 18 Feb 2025 18:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Tue, 11 Feb 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 11 Feb 2025 09:30:00 +0000

Type	Values Removed	Values Added
Description		The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password cracking attempts. The recovered credentials can be used to log into the device via the login shell that is exposed by the serial interface. The backdoor user has been removed in firmware BSP >= 6.4.1.
Title		Weak Hard-coded Credentials
Weaknesses		CWE-798
References		https://r.sec-consult.com/wattsense https://support.wattsense.com/hc/en-150/articles/13366066529437-Release-Notes

MITRE

Status: PUBLISHED

Assigner: SEC-VLab

Published: 2025-02-11T09:20:22.708Z

Updated: 2025-03-18T18:27:29.653Z

Reserved: 2025-02-10T07:48:38.352Z

Link: CVE-2025-26410

Vulnrichment

Updated: 2025-02-11T14:36:43.042Z

NVD

Status : Awaiting Analysis

Published: 2025-02-11T10:15:09.863

Modified: 2025-03-18T19:15:50.450

Link: CVE-2025-26410

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-26410", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2025-02-10T07:48:38.352Z", "datePublished": "2025-02-11T09:20:22.708Z", "dateUpdated": "2025-03-18T18:27:29.653Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "Wattsense Bridge", "vendor": "Wattsense", "versions": [{"lessThan": "6.4.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Constantin Schieber-Kn\u00f6bl | SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Stefan Schweighofer | SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Steffen Robertz | SEC Consult Vulnerability Lab"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password cracking attempts. The recovered credentials can be used to log into the device via the login shell that is exposed by the serial interface. The backdoor user has been removed in firmware BSP >= 6.4.1.<br>"}], "value": "The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password cracking attempts. The recovered credentials can be used to log into the device via the login shell that is exposed by the serial interface. The backdoor user has been removed in firmware BSP >= 6.4.1."}], "impacts": [{"capecId": "CAPEC-653", "descriptions": [{"lang": "en", "value": "CAPEC-653 Use of Known Operating System Credentials"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2025-02-11T09:20:22.708Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://r.sec-consult.com/wattsense"}, {"tags": ["release-notes"], "url": "https://support.wattsense.com/hc/en-150/articles/13366066529437-Release-Notes"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "This issue is fixed in recent firmware versions BSP >= 6.4.1."}], "value": "This issue is fixed in recent firmware versions BSP >= 6.4.1."}], "source": {"discovery": "EXTERNAL"}, "title": "Weak Hard-coded Credentials", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-02-11T14:35:57.904824Z", "id": "CVE-2025-26410", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-18T18:27:29.653Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-26410", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-11T14:35:57.904824Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T14:36:43.042Z"}}], "cna": {"title": "Weak Hard-coded Credentials", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Constantin Schieber-Kn\u00f6bl | SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Stefan Schweighofer | SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Steffen Robertz | SEC Consult Vulnerability Lab"}], "impacts": [{"capecId": "CAPEC-653", "descriptions": [{"lang": "en", "value": "CAPEC-653 Use of Known Operating System Credentials"}]}], "affected": [{"vendor": "Wattsense", "product": "Wattsense Bridge", "versions": [{"status": "affected", "version": "0", "lessThan": "6.4.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "This issue is fixed in recent firmware versions BSP >= 6.4.1.", "supportingMedia": [{"type": "text/html", "value": "This issue is fixed in recent firmware versions BSP >= 6.4.1.", "base64": false}]}], "references": [{"url": "https://r.sec-consult.com/wattsense", "tags": ["third-party-advisory"]}, {"url": "https://support.wattsense.com/hc/en-150/articles/13366066529437-Release-Notes", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password cracking attempts. The recovered credentials can be used to log into the device via the login shell that is exposed by the serial interface. The backdoor user has been removed in firmware BSP >= 6.4.1.", "supportingMedia": [{"type": "text/html", "value": "The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password cracking attempts. The recovered credentials can be used to log into the device via the login shell that is exposed by the serial interface. The backdoor user has been removed in firmware BSP >= 6.4.1.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2025-02-11T09:20:22.708Z"}}}, "cveMetadata": {"cveId": "CVE-2025-26410", "state": "PUBLISHED", "dateUpdated": "2025-03-18T18:27:29.653Z", "dateReserved": "2025-02-10T07:48:38.352Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2025-02-11T09:20:22.708Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.1"}