CVE-2026-26049

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26049", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-02-10T15:52:10.261Z", "datePublished": "2026-02-20T16:03:56.928Z", "dateUpdated": "2026-02-20T19:58:24.669Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "USR-W610", "vendor": "Jinan USR IOT Technology Limited (PUSR)", "versions": [{"lessThanOrEqual": "3.1.1.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Abhishek Pandey of Payatu Security Consulting reported this to CISA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The web management interface of the device renders the passwords in a \nplaintext input field. The current password is directly visible to \nanyone with access to the UI, potentially exposing administrator \ncredentials to unauthorized observation via shoulder surfing, \nscreenshots, or browser form caching."}], "value": "The web management interface of the device renders the passwords in a \nplaintext input field. The current password is directly visible to \nanyone with access to the UI, potentially exposing administrator \ncredentials to unauthorized observation via shoulder surfing, \nscreenshots, or browser form caching."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-522", "description": "CWE-522", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-02-20T16:07:25.350Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-03"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json"}], "source": {"advisory": "ICSA-26-050-03", "discovery": "EXTERNAL"}, "tags": ["unsupported-when-assigned"], "title": "Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Jinan USR IOT Technology Limited (PUSR) has stated that the product is \nend-of-life, and there are no plans to patch. Users of PUSR USR-W610 \ndevices are encouraged to <a target=\"_blank\" rel=\"nofollow\">contact PUSR</a> and keep their systems up to date.\n\n<br>"}], "value": "Jinan USR IOT Technology Limited (PUSR) has stated that the product is \nend-of-life, and there are no plans to patch. Users of PUSR USR-W610 \ndevices are encouraged to contact PUSR and keep their systems up to date."}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T19:57:14.798564Z", "id": "CVE-2026-26049", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T19:58:24.669Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26049", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T19:57:14.798564Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T19:58:08.412Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials", "source": {"advisory": "ICSA-26-050-03", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Abhishek Pandey of Payatu Security Consulting reported this to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Jinan USR IOT Technology Limited (PUSR)", "product": "USR-W610", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.1.1.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-03"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json"}], "workarounds": [{"lang": "en", "value": "Jinan USR IOT Technology Limited (PUSR) has stated that the product is \nend-of-life, and there are no plans to patch. Users of PUSR USR-W610 \ndevices are encouraged to contact PUSR and keep their systems up to date.", "supportingMedia": [{"type": "text/html", "value": "Jinan USR IOT Technology Limited (PUSR) has stated that the product is \nend-of-life, and there are no plans to patch. Users of PUSR USR-W610 \ndevices are encouraged to <a target=\"_blank\" rel=\"nofollow\">contact PUSR</a> and keep their systems up to date.\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The web management interface of the device renders the passwords in a \nplaintext input field. The current password is directly visible to \nanyone with access to the UI, potentially exposing administrator \ncredentials to unauthorized observation via shoulder surfing, \nscreenshots, or browser form caching.", "supportingMedia": [{"type": "text/html", "value": "The web management interface of the device renders the passwords in a \nplaintext input field. The current password is directly visible to \nanyone with access to the UI, potentially exposing administrator \ncredentials to unauthorized observation via shoulder surfing, \nscreenshots, or browser form caching.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-02-20T16:07:25.350Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26049", "state": "PUBLISHED", "dateUpdated": "2026-02-20T19:58:24.669Z", "dateReserved": "2026-02-10T15:52:10.261Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-02-20T16:03:56.928Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "USR-W610", "vendor": "Jinan USR IOT Technology Limited (PUSR)", "versions": [{"lessThanOrEqual": "3.1.1.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [{"sourceIdentifier": "ics-cert@hq.dhs.gov", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "The web management interface of the device renders the passwords in a \nplaintext input field. The current password is directly visible to \nanyone with access to the UI, potentially exposing administrator \ncredentials to unauthorized observation via shoulder surfing, \nscreenshots, or browser form caching."}, {"lang": "es", "value": "La interfaz de gesti\u00f3n web del dispositivo muestra las contrase\u00f1as en un campo de entrada de texto sin formato. La contrase\u00f1a actual es directamente visible para cualquiera con acceso a la UI, lo que podr\u00eda exponer las credenciales de administrador a una observaci\u00f3n no autorizada mediante 'shoulder surfing', capturas de pantalla o el almacenamiento en cach\u00e9 del formulario del navegador."}], "id": "CVE-2026-26049", "lastModified": "2026-06-17T10:25:38.867", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26049", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T19:57:14.798564Z", "version": "2.0.3"}}]}, "published": "2026-02-20T17:25:53.623", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-03"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.1.1.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "USR-W610", "source": "cna", "vendor": "Jinan USR IOT Technology Limited (PUSR)"}, "product": "usr-w610", "vendor": "jinan_usr_iot_technology_limited_(pusr)"}], "analysis": {"en": {"generated_at": "2026-04-17T17:23:07.197173+00:00", "value": {"mitigation_remediation": ["Restrict access to the device\u2019s web management interface to a trusted internal network or VPN only.", "Change the administrator password to a strong, unique value and enforce periodic password updates.", "Replace or upgrade the device to a vendor\u2011maintained alternative that securely stores credentials and removes plaintext password rendering."], "summary": {"action": "Mitigate", "impact": "Credential Exposure via plaintext password visibility"}, "threat_synthesis": {"affected_systems": "This issue affects the PUSR USR\u2011W610 model produced by Jinan USR IOT Technology Limited. No specific firmware or hardware revision numbers are provided, so all units of this model are considered vulnerable.", "description_and_impact": "The web management interface of the PUSR USR\u2011W610 device displays the current administrator password in a plaintext input field. An individual with access to the interface can observe the entire password, exposing credentials to shoulder\u2011surfing attacks, screenshots, or browser form caching. This vulnerability allows malicious actors to obtain valid authentication credentials, potentially enabling unauthorized configuration changes or network access if the credentials are used elsewhere.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 5.7, indicating moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed public exploits. The likely attack vector is local to anyone who can access the device\u2019s management interface, either physically or over a network where the UI is reachable. Due to the lack of a vendor patch and the device\u2019s end\u2011of\u2011life status, the risk persists until mitigated by configuration changes or device replacement."}}}}, "created": "2026-02-23T14:35:43.098744+00:00", "updated": "2026-04-17T17:30:23.862012+00:00", "vendors": ["jinan_usr_iot_technology_limited_(pusr)", "jinan_usr_iot_technology_limited_(pusr)$PRODUCT$usr-w610"]}