{"id":"CVE-2026-26049","state":"PUBLISHED","title":"Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials","description":"The web management interface of the device renders the passwords in a \nplaintext input field. The current password is directly visible to \nanyone with access to the UI, potentially exposing administrator \ncredentials to unauthorized observation via shoulder surfing, \nscreenshots, or browser form caching.","publishedAt":"2026-02-20T16:03:56.928Z","updatedAt":"2026-02-20T19:58:24.669Z","severity":{"score":5.7,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","source":"icscert"},"assigner":"icscert","products":["Jinan USR IOT Technology Limited (PUSR) USR-W610"],"affected":[{"vendor":"Jinan USR IOT Technology Limited (PUSR)","product":"USR-W610","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.1.1.0","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-03","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json"],"weaknesses":["CWE-522"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/26xxx/CVE-2026-26049.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-26049","state":"PUBLISHED","datePublished":"2026-02-20T16:03:56.928Z","dateUpdated":"2026-02-20T19:58:24.669Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2026-02-10T15:52:10.261Z"},"containers":{"cna":{"title":"Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials","descriptions":[{"lang":"en","value":"The web management interface of the device renders the passwords in a \nplaintext input field. The current password is directly visible to \nanyone with access to the UI, potentially exposing administrator \ncredentials to unauthorized observation via shoulder surfing, \nscreenshots, or browser form caching."}],"affected":[{"vendor":"Jinan USR IOT Technology Limited (PUSR)","product":"USR-W610","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.1.1.0","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-03"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-03.json"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-522","description":"CWE-522","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2026-02-20T16:07:25.350Z"},"credits":[{"lang":"en","type":"finder","value":"Abhishek Pandey of Payatu Security Consulting reported this to CISA."}],"source":{"advisory":"ICSA-26-050-03","discovery":"EXTERNAL"},"tags":["unsupported-when-assigned"],"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Jinan USR IOT Technology Limited (PUSR) has stated that the product is \nend-of-life, and there are no plans to patch. Users of PUSR USR-W610 \ndevices are encouraged to <a target=\"_blank\" rel=\"nofollow\">contact PUSR</a> and keep their systems up to date.\n\n<br>"}],"value":"Jinan USR IOT Technology Limited (PUSR) has stated that the product is \nend-of-life, and there are no plans to patch. Users of PUSR USR-W610 \ndevices are encouraged to contact PUSR and keep their systems up to date."}],"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-20T19:57:14.798564Z","id":"CVE-2026-26049","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-20T19:58:24.669Z"}}]}}}