CVE-2025-26408: Unprotected JTAG Interface
First published: Tue Feb 11 2025(Updated: )
The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the interface, full access to the device is possible. This enables an attacker to extract information, modify and debug the device's firmware. All known versions are affected.
Credit: 551230f0-3615-47bd-b7cc-93e92e730bbf
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wattsense Bridge | <= |
Remedy
The device is meant to be installed at a restricted access physical location according to the vendor and exploitation requires more attacker knowledge and higher physical access. The issue will be put in the backlog of the Wattsense team.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-26408?
CVE-2025-26408 is considered a high severity vulnerability due to the potential for unauthorized access and manipulation of firmware.
How do I fix CVE-2025-26408?
To fix CVE-2025-26408, ensure physical security of the Wattsense Bridge devices to prevent unauthorized JTAG access.
What devices are affected by CVE-2025-26408?
CVE-2025-26408 affects all known versions of the Wattsense Bridge devices.
What are the risks of CVE-2025-26408?
The risks of CVE-2025-26408 include unauthorized access to sensitive information and the capability to modify device firmware.
Can CVE-2025-26408 be exploited remotely?
CVE-2025-26408 cannot be exploited remotely, as it requires physical access to the device's PCB.
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/references
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/author
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/wattsense
- canonical/wattsense bridge