CVE-2025-26408

Unprotected JTAG Interface

Description

The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the interface, full access to the device is possible. This enables an attacker to extract information, modify and debug the device's firmware. All known versions are affected.

Remediation

Solution:

  • The device is meant to be installed at a restricted access physical location according to the vendor and exploitation requires more attacker knowledge and higher physical access. The issue will be put in the backlog of the Wattsense team.

Category

6.1
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.02%
Third-Party Advisory sec-consult.com
Affected: Wattsense Wattsense Bridge
Published at:
Updated at:

References

Link Tags
https://r.sec-consult.com/wattsense third party advisory
https://support.wattsense.com/hc/en-150/articles/13366066529437-Release-Notes release notes

Frequently Asked Questions

What is the severity of CVE-2025-26408?
CVE-2025-26408 has been scored as a medium severity vulnerability.
How to fix CVE-2025-26408?
To fix CVE-2025-26408: The device is meant to be installed at a restricted access physical location according to the vendor and exploitation requires more attacker knowledge and higher physical access. The issue will be put in the backlog of the Wattsense team.
Is CVE-2025-26408 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2025-26408 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-26408?
CVE-2025-26408 affects Wattsense Wattsense Bridge.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.