CVE-2026-24455

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24455", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-02-10T15:52:10.245Z", "datePublished": "2026-02-20T16:00:42.396Z", "dateUpdated": "2026-02-20T20:01:11.347Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "USR-W610", "vendor": "Jinan USR IOT Technology Limited (PUSR)", "versions": [{"lessThanOrEqual": "3.1.1.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Abhishek Pandey of Payatu Security Consulting reported this to CISA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The embedded web interface of the device does not support HTTPS/TLS for \nauthentication and uses HTTP Basic Authentication. Traffic is encoded \nbut not encrypted, exposing user credentials to passive interception by \nattackers on the same network."}], "value": "The embedded web interface of the device does not support HTTPS/TLS for \nauthentication and uses HTTP Basic Authentication. Traffic is encoded \nbut not encrypted, exposing user credentials to passive interception by \nattackers on the same network."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-319", "description": "CWE-319", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-02-20T16:00:42.396Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-03"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json"}], "source": {"advisory": "ICSA-26-050-03", "discovery": "EXTERNAL"}, "tags": ["unsupported-when-assigned"], "title": "Jinan USR IOT Technology Limited (PUSR) USR-W610 Cleartext Transmission of Sensitive Information", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Jinan USR IOT Technology Limited (PUSR) has stated that the product is \nend-of-life, and there are no plans to patch. Users of PUSR USR-W610 \ndevices are encouraged to <a target=\"_blank\" rel=\"nofollow\">contact PUSR</a> and keep their systems up to date.\n\n<br>"}], "value": "Jinan USR IOT Technology Limited (PUSR) has stated that the product is \nend-of-life, and there are no plans to patch. Users of PUSR USR-W610 \ndevices are encouraged to contact PUSR and keep their systems up to date."}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T20:00:37.730069Z", "id": "CVE-2026-24455", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T20:01:11.347Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24455", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T20:00:37.730069Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T20:01:02.805Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "Jinan USR IOT Technology Limited (PUSR) USR-W610 Cleartext Transmission of Sensitive Information", "source": {"advisory": "ICSA-26-050-03", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Abhishek Pandey of Payatu Security Consulting reported this to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Jinan USR IOT Technology Limited (PUSR)", "product": "USR-W610", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.1.1.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-03"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json"}], "workarounds": [{"lang": "en", "value": "Jinan USR IOT Technology Limited (PUSR) has stated that the product is \nend-of-life, and there are no plans to patch. Users of PUSR USR-W610 \ndevices are encouraged to contact PUSR and keep their systems up to date.", "supportingMedia": [{"type": "text/html", "value": "Jinan USR IOT Technology Limited (PUSR) has stated that the product is \nend-of-life, and there are no plans to patch. Users of PUSR USR-W610 \ndevices are encouraged to <a target=\"_blank\" rel=\"nofollow\">contact PUSR</a> and keep their systems up to date.\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The embedded web interface of the device does not support HTTPS/TLS for \nauthentication and uses HTTP Basic Authentication. Traffic is encoded \nbut not encrypted, exposing user credentials to passive interception by \nattackers on the same network.", "supportingMedia": [{"type": "text/html", "value": "The embedded web interface of the device does not support HTTPS/TLS for \nauthentication and uses HTTP Basic Authentication. Traffic is encoded \nbut not encrypted, exposing user credentials to passive interception by \nattackers on the same network.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-319", "description": "CWE-319"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-02-20T16:00:42.396Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24455", "state": "PUBLISHED", "dateUpdated": "2026-02-20T20:01:11.347Z", "dateReserved": "2026-02-10T15:52:10.245Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-02-20T16:00:42.396Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "USR-W610", "vendor": "Jinan USR IOT Technology Limited (PUSR)", "versions": [{"lessThanOrEqual": "3.1.1.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [{"sourceIdentifier": "ics-cert@hq.dhs.gov", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "The embedded web interface of the device does not support HTTPS/TLS for \nauthentication and uses HTTP Basic Authentication. Traffic is encoded \nbut not encrypted, exposing user credentials to passive interception by \nattackers on the same network."}, {"lang": "es", "value": "La interfaz web integrada del dispositivo no es compatible con HTTPS/TLS para autenticaci\u00f3n y utiliza Autenticaci\u00f3n B\u00e1sica HTTP. El tr\u00e1fico est\u00e1 codificado pero no cifrado, exponiendo las credenciales de usuario a la interceptaci\u00f3n pasiva por atacantes en la misma red."}], "id": "CVE-2026-24455", "lastModified": "2026-06-17T10:23:05.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24455", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T20:00:37.730069Z", "version": "2.0.3"}}]}, "published": "2026-02-20T17:25:51.143", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-03"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.1.1.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "USR-W610", "source": "cna", "vendor": "Jinan USR IOT Technology Limited (PUSR)"}, "product": "usr-w610", "vendor": "jinan_usr_iot_technology_limited_(pusr)"}], "analysis": {"en": {"generated_at": "2026-04-18T11:31:51.798650+00:00", "value": {"mitigation_remediation": ["Contact PUSR vendor to discuss replacement or temporary solutions, as no patch is available and the device is end\u2011of\u2011life.", "Isolate the device on a dedicated network segment or firewall it behind a secure gateway to limit passive sniffing opportunities.", "Consider replacing the USR\u2011W610 with a device that supports HTTPS/TLS or implementing a secure tunnel (e.g., VPN or reverse proxy) to access the web interface.", "If replacement is not immediately possible, monitor network traffic for HTTP authentication exchanges and ensure credential credentials are changed regularly to reduce exposure."], "summary": {"action": "Replace Device", "impact": "Potential Credential Theft via Unencrypted HTTP Basic Authentication"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts the Jinan USR IOT Technology Limited (PUSR) USR\u2011W610 devices. No specific firmware or build numbers are listed, and the product is listed as end\u2011of\u2011life by the vendor, which implies no forthcoming patches will be released.", "description_and_impact": "The embedded web interface of the device does not support HTTPS/TLS for authentication and instead uses HTTP Basic Authentication; traffic is merely encoded, not encrypted, exposing user credentials to passive network sniffing. This flaw, identified as CWE\u2011319, allows an attacker capable of eavesdropping on the local network to capture account names and passwords, potentially granting unauthorized control of the device's functions and the sensitive data it manages.", "risk_and_exploitability": "With a CVSS score of 7.5, the severity is high. The EPSS score is listed as <\u202f1\u202f%, indicating a low probability of exploitation in the wild, and the vulnerability is not catalogued in the CISA KEV list. The likely attack vector is passive interception on the same local network; an adversary does not need to execute code but must be able to sniff network traffic. While the immediate threat is credential disclosure, compromised credentials could lead to broader compromise of connected systems. Overall the risk remains moderate to high for networks that are not properly segmented or isolated."}}}}, "created": "2026-02-23T14:35:46.473357+00:00", "updated": "2026-04-18T11:45:44.582689+00:00", "vendors": ["jinan_usr_iot_technology_limited_(pusr)", "jinan_usr_iot_technology_limited_(pusr)$PRODUCT$usr-w610"]}