CVE-2026-7786 PUBLISHED

Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter Use of Hard-coded Credentials

Assigner: icscert
Reserved: 04.05.2026 Published: 29.05.2026 Updated: 29.05.2026

Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter device firmware contains plaintext administrative credentials embedded in the firmware image. These credentials can be extracted through firmware analysis and used to authenticate to device services.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor Jinan USR IOT Technology Limited (PUSR)
Product USR-W610 RS232/485 to Wi-Fi/Ethernet Converter
Versions Default: unaffected
  • Version 7.03T.07 is affected

Workarounds

Jinan USR IOT Technology Limited (PUSR) did not respond to CISA's attempts at coordination. Users of PUSR USR-W610 devices are encouraged to contact PUSR and keep their systems up to date.

Credits

  • Arun Mane and Omkar Mali reported this vulnerability to CISA. finder

References

Problem Types

  • CWE-798 CWE