Cyber Security News

Jinan USR IOT Technology Limited (PUSR) USR-W610 | CISA

Cyware
Jinan USR IOT Technology Limited (PUSR) USR-W610 | CISA

Multiple critical vulnerabilities (CVE-2026-25715, CVE-2026-24455, CVE-2026-26049, CVE-2026-26048) in the Jinan USR IOT PUSR USR-W610 (

Keypoints

  • Four critical CVEs affect Jinan USR IOT PUSR USR-W610 firmware versions
  • CVE-2026-25715 allows administrator credentials to be set blank, effectively disabling authentication for web and Telnet access.
  • CVE-2026-24455 uses HTTP Basic Auth without TLS, exposing credentials to passive interception.
  • CVE-2026-26049 reveals passwords in plaintext UI fields and CVE-2026-26048 enables deauthentication DoS via missing Management Frame Protection.
  • CISA advises network isolation, firewalling, updated VPNs, and ICS hardening; Payatu Security researchers reported the vulnerabilities.

Read More: https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-03