CVE-2026-26049

Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials

CVSS 5.7 MEDIUMEPSS 0.3%CWE-522

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.7EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

20 fev 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access to the UI, potentially exposing administrator credentials to unauthorized observation via shoulder surfing, screenshots, or browser form caching.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Produtos afetados

Jinan USR IOT Technology Limited (PUSR) · USR-W610

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-03