Description
The web management interface of the device allows the administrator
username and password to be set to blank values. Once applied, the
device permits authentication with empty credentials over the web
management interface and Telnet service. This effectively disables
authentication across all critical management channels, allowing any
network-adjacent attacker to gain full administrative control without
credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jinan USR IOT Technology Limited (PUSR) | USR-W610 | ≤ 3.1.1.0 | — |
Advisories 1
- ICSA-26-050-03 Jinan USR IOT Technology Limited (PUSR) USR-W610 CISA ICS & IT advisories · Feb 19, 2026