Vulnerability · Published Feb 20, 2026 · Assigned by icscert
CVE-2026-25715Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements
Critical 9.8
In plain English
A critical-severity security flaw in USR-W610 from Jinan USR IOT Technology Limited (PUSR). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Official description
The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively disables authentication across all critical management channels, allowing any network-adjacent attacker to gain full administrative control without credentials.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Jinan USR IOT Technology Limited (PUSR) | USR-W610 | 0 – through 3.1.1.0 |
Weakness: CWE-521 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H