The web management interface of the device allows the administrator
username and password to be set to blank values. Once applied, the
device permits authentication with empty credentials over the web
management interface and Telnet service. This effectively disables
authentication across all critical management channels, allowing any
network-adjacent attacker to gain full administrative control without
credentials.
Jinan USR IOT Technology Limited (PUSR) has stated that the product is
end-of-life, and there are no plans to patch. Users of PUSR USR-W610
devices are encouraged to contact PUSR and keep their systems up to date.