CVE-2025-26411CWE-434

Authenticated Arbitrary Python File Upload via Plugin Manager

High · published February 11, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
52.7
In the wild
Unconfirmed
What it is

An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python files to the device. This enables an attacker to gain remote root access to the device. An attacker needs a valid user account on the Wattsense web interface to be able to conduct this attack. This issue is fixed in recent firmware versions BSP >= 6.1.0.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00702 · 52.7th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-02-11T09:21Z
EPSS history
Timeline
  • 11 FEB 09:21Z
    Authenticated Arbitrary Python File Upload via Plugin Manager
    cvelistv5