PT-2026-21239 · Jinan Usr Iot Technology Limited · Usr-W610

Abhishek Pandey · Published 2026-02-20 · Updated 2026-02-20 · CVE-2026-25715

NVD

CVSS v3.1

9.8

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively disables authentication across all critical management channels, allowing any network-adjacent attacker to gain full administrative control without credentials.

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2026-25715

Affected Products

Usr-W610

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-25715 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-050-03 · Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json · Note