CVE-2026-7786

34th percentile - higher than 34% of all known CVEs

The firmware of the USR-W610 RS232/485 Wi-Fi/Ethernet Converter by Jinan USR IOT Technology Limited (PUSR) contains plaintext administrative credentials embedded in the firmware image. These credentials can be extracted through firmware analysis and used to authenticate to device services.

An attacker who gains access to the firmware image (e.g., by downloading it from the vendor's website or intercepting an update) can read the administrator password and take full control of the device. This could lead to compromise of confidentiality and integrity of data transmitted through the converter and enable further attacks on the local network.

Immediately change the default administrator password to a strong, unique password. The vendor should release a firmware update that removes plaintext credentials and implements secure password storage (e.g., salted hash). Until the update is applied, restrict device access to trusted networks only.