PT-2026-21239 · Jinan Usr Iot Technology Limited · Usr-W610

Abhishek Pandey · Publicado 2026-02-20 · Atualizado 2026-02-24 · CVE-2026-25715

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. (affected versions not specified)

Description The web management interface allows the administrator username and password to be set to blank values. After applying these blank values, the device allows authentication with empty credentials via the web management interface and Telnet service. This disables authentication across critical management channels, potentially granting full administrative control to any network-adjacent attacker without requiring credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-521

Identificadores relacionados

CVE-2026-25715

Produtos afetados

Usr-W610

Referências · 8

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json · Nota
• https://twitter.com/vuln_tracker/status/2026195517789839502 · Publicação no Twitter
• https://cisa.gov/news-events/ics-advisories/icsa-26-050-03 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-25715 · Nota de Segurança
• https://twitter.com/the_yellow_fall/status/2026120445393600936 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2024904441879724397 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2024988809021325556 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2024902080222114166 · Publicação no Twitter