by Kastro
Paper/Archive/CVE-2026-25715

CVE-2026-25715

Jinan USR IOT Technology Limited (PUSR) USR-W610 — Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.4.504 × 2010.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively disables authentication across all critical management channels, allowing any network-adjacent attacker to gain full administrative control without credentials.

Affected

ProductAffectedFixed inSource
USR-W610≤ 3.1.1.0–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-26-050-03refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json