CVE-2025-26409
Raw vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-26409 is a medium-severity On-Chip Debug and Test Interface With Improper Access Control (CWE-1191) vulnerability in Sec Consult (inferred from references). Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Abuse Elevation Control Mechanism (T1548); ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4192
Vulnerability Data
A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the interface, access to the bootloader is possible, as well as a Linux login prompt. The bootloader access can be used…
more
to gain a root shell on the device. This issue is fixed in recent firmware versions BSP >= 6.4.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V13.3.3V13.3.2
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly requires enforcement of authorization checks on all logical access paths, which would block unauthorized use of the debug/test interface registers.
AC-6 requires restricting access rights to the minimum needed, limiting what an attacker reaching the debug interface can actually read or modify.
IA-3 requires device identification and authentication before any connection is established, which would apply to external debug or test equipment.
SC-7 mandates control at all external and key internal interfaces, preventing access-control bypass through alternate hardware paths.
CM-7 disables or restricts unnecessary ports and interfaces, eliminating many alternate hardware paths before they can be exploited.
SC-3 isolates security functions so that alternate interfaces cannot reach protected assets without passing through the reference monitor.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Defining and enforcing access permissions directly addresses improper authorization to debug interfaces.
Managing physical access to assets covers control of on-chip debug/test ports and pins.
CWE-1299 can impair DE.CM-09 by letting adverse events on unguarded alternate interfaces evade monitoring that assumes primary paths, yet the weakness only affects one narrow slice of the broad monitoring outcome.
Authentication of hardware can help restrict debug interface use but is narrower than full access control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure system architecture and engineering principles require protection of all interfaces, directly addressing unguarded alternate hardware paths.
Security testing can discover improper debug access but does not itself implement the control.
Physical perimeters can limit access to debug ports but do not address on-chip access-control logic.
Physical entry controls reduce the chance of an attacker reaching the chip but do not enforce on-chip debug authorization.
Privileged-access rules may extend to hardware debug interfaces, yet the control is not hardware-specific.
Secure SDLC encourages hardware security requirements but does not mandate debug-port controls.