All Wattsense Bridge devices have firmware containing identical hard-coded user and root credentials. The user password can be recovered through password cracking, allowing unauthorized access via the device's serial interface login shell. This backdoor user was removed starting with firmware version BSP 6.4.1. The vulnerability has a critical severity with a CVSS score of 9.8.