Insecure Authentication in Device Web Management Interface by Vendor
CVE-2026-25715

9.8CRITICAL

Key Information:

Vendor

Jinan Usr Iot Technology Limited (pusr)

Status
Usr-w610
Vendor
CVE Published:
20 February 2026

What is CVE-2026-25715?

The web management interface of certain devices allows administrators to set both the username and password to empty values. This severe flaw permits authentication with these blank credentials, effectively bypassing authentication requirements across critical management channels. As a result, any network-adjacent attacker can gain full administrative access to the device without any valid authentication, posing significant security risks.

Affected Version(s)

USR-W610 0 <= 3.1.1.0

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-0...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Pandey of Payatu Security Consulting reported this to CISA.
.