What’s Vulnerable › Vulnerabilities

CVE-2026-26049: Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-20 · updated 2026-06-17
• Weakness: CWE-522

Description

The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access to the UI, potentially exposing administrator credentials to unauthorized observation via shoulder surfing, screenshots, or browser form caching.

Affected products

• Jinan USR IOT Technology Limited (PUSR) USR-W610: through 3.1.1.0

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-03

Get alerted when CVE-2026-26049 or the next vulnerability affects your stack