CVE-2026-26049

Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials

State: Published
Severity: 5.7 Medium
Published: Feb 20, 2026
Updated: Feb 20, 2026
Reserved: Feb 10, 2026

Description

The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access to the UI, potentially exposing administrator credentials to unauthorized observation via shoulder surfing, screenshots, or browser form caching.

Scores

CVSS	Score	Vector	Source
3.1	5.7 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N	icscert

Weaknesses

CWE-522

Affected Products

Product	Versions
USR-W610Jinan USR IOT Technology Limited (PUSR)	3.1.1.0 and earlierAffected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-03
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.