Critical · published February 11, 2025
🚨 All Wattsense Bridge devices are playing a high-stakes game with hard-coded credentials – like leaving the front door wide open with a welcome mat that says 'Come on in!' 🔥 Think of it as a restaurant that has the same key for every table. Anyone who cracks the code can waltz right in, sit down, and reorder anything on the menu without a reservation! An attacker could easily retrieve the user password through cracking attempts and gain full control of the device. This means they can manipulate settings, steal sensitive information, or even create havoc in the connected systems – an absolute disaster waiting to happen!
Think of it as a restaurant that has the same key for every table. Anyone who cracks the code can waltz right in, sit down, and reorder anything on the menu without a reservation! The vulnerability resides in the firmware of all Wattsense Bridge devices, where hard-coded credentials are used. Specifically, the user password can be recovered via basic password cracking techniques, allowing access to the device through an exposed login shell on the serial interface.
An attacker could easily retrieve the user password through cracking attempts and gain full control of the device. This means they can manipulate settings, steal sensitive information, or even create havoc in the connected systems – an absolute disaster waiting to happen! Immediately upgrade to firmware version BSP >= 6.4.1 to eliminate the hard-coded backdoor user. Additionally, audit your device configurations and consider implementing stronger, unique passwords to enhance security. You've got this! Follow these steps to secure your devices and maintain your superhero status! 🦸♂️