CVE-2026-26049CWE-522

Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials

Medium · published February 20, 2026

CVSS v3.1
5.7
EPSS
0%
Percentile
34.4
In the wild
Unconfirmed
What it is

The web management interface of the device renders the passwords in a

plaintext input field. The current password is directly visible to

anyone with access to the UI, potentially exposing administrator

credentials to unauthorized observation via shoulder surfing,

screenshots, or browser form caching.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.4th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-02-20T16:03Z
EPSS history
Timeline
  • 20 FEB 16:03Z
    Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials
    cvelistv5