Machine-generated analysis · WAYSCloud LLM
The advisory states that hard-coded administrative credentials are present in the firmware of the affected device, which can be extracted and used to gain unauthorized access.
Context
The Jinan USR IOT Technology Limited (PUSR) USR-W610 is an RS232/485 to Wi-Fi/Ethernet converter used to bridge serial devices to networked environments. The advisory states that version 7.03T.07 contains hard-coded credentials in the firmware that can be extracted and used to authenticate to device services. This issue affects devices deployed worldwide, and the vendor did not respond to CISA's coordination attempts. Worth noting is that the credentials are stored in plaintext, making them easily accessible through firmware analysis.
Operator considerations
Check: Inventory all USR-W610 devices running firmware version 7.03T.07
Successful exploitation of this vulnerability could result in an attacker gaining administrator access to the device.
Read the full advisory on CISA →