Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-7786

Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter Use of Hard-coded Credentials

Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter device firmware contains plaintext administrative credentials embedded in the firmware image. These credentials can be extracted through firmware analysis and used to authenticate to device services.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Jinan Usr Iot Technology Limited (pusr)
Products
Usr-w610 Rs232/485 To Wi-fi/ethernet Converter
CVE-2026-25715

Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements

The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively disables authentication across all critical management channels, allowing any network-adjacent attacker to gain full administrative control without credentials.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Jinan Usr Iot Technology Limited (pusr)
Products
Usr-w610
CVE-2026-24455

Jinan USR IOT Technology Limited (PUSR) USR-W610 Cleartext Transmission of Sensitive Information

The embedded web interface of the device does not support HTTPS/TLS for authentication and uses HTTP Basic Authentication. Traffic is encoded but not encrypted, exposing user credentials to passive interception by attackers on the same network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Jinan Usr Iot Technology Limited (pusr)
Products
Usr-w610
CVE-2026-26048

Jinan USR IOT Technology Limited (PUSR) USR-W610 Missing Authentication for Critical Function

The Wi-Fi router is vulnerable to de-authentication attacks due to the absence of management frame protection, allowing forged deauthentication and disassociation frames to be broadcast without authentication or encryption. An attacker can use this to cause unauthorized disruptions and create a denial-of-service condition.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Jinan Usr Iot Technology Limited (pusr)
Products
Usr-w610
CVE-2026-26049

Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials

The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access to the UI, potentially exposing administrator credentials to unauthorized observation via shoulder surfing, screenshots, or browser form caching.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Jinan Usr Iot Technology Limited (pusr)
Products
Usr-w610