CVE-2026-24455

Jinan USR IOT Technology Limited (PUSR) USR-W610 Cleartext Transmission of Sensitive Information

State: Published
Severity: 7.5 High
Published: Feb 20, 2026
Updated: Feb 20, 2026
Reserved: Feb 10, 2026

Description

The embedded web interface of the device does not support HTTPS/TLS for authentication and uses HTTP Basic Authentication. Traffic is encoded but not encrypted, exposing user credentials to passive interception by attackers on the same network.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	icscert

Weaknesses

CWE-319

Affected Products

Product	Versions
USR-W610Jinan USR IOT Technology Limited (PUSR)	3.1.1.0 and earlierAffected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-03
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.