Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-521.
Summary
The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively disables authentication across all critical management channels, allowing any network-adjacent attacker to gain full administrative control without credentials.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Jinan USR IOT Technology Limited (PUSR) | USR-W610 | up to 3.1.1.0 | — | No fix listed | CNA |
- USR-W610 VendorJinan USR IOT Technology Limited (PUSR) Affected up to 3.1.1.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25715
- 2026-10-03 Alias added: GHSA-7689-4fm5-8xxm
References
More Jinan USR IOT Technology Limited (PUSR) vulnerabilities
- TI-2026-06857 Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter Use of Hard-coded Credentials CVSS 3.1CRITICAL 9.8
- TI-2026-21053 Jinan USR IOT Technology Limited (PUSR) USR-W610 Missing Authentication for Critical Function CVSS 3.1HIGH 7.5
- TI-2026-19716 Jinan USR IOT Technology Limited (PUSR) USR-W610 Cleartext Transmission of Sensitive Information CVSS 3.1HIGH 7.5
- TI-2026-21054 Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials CVSS 3.1MEDIUM 5.7
Sources
- CVE-2026-25715 · CVE Program
- CVE-2026-25715 · NVD
- FIRST EPSS
- GHSA-7689-4fm5-8xxm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences