CVE-2026-7786: USR-W610 Information Disclosure Flaw

CVE-2026-7786 Overview

CVE-2026-7786 is a hardcoded credentials vulnerability [CWE-798] affecting the Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter. The device firmware contains plaintext administrative credentials embedded directly in the firmware image. Attackers can extract these credentials through standard firmware analysis techniques and use them to authenticate to device services over the network. The vulnerability requires no privileges or user interaction and is exploitable remotely. CISA published advisory ICSA-26-148-02 to document the issue in this industrial communications converter.

Critical Impact
Unauthenticated remote attackers can recover administrative credentials from the firmware image and gain full control of affected USR-W610 converters, compromising confidentiality, integrity, and availability of attached serial and network devices.

Affected Products

PUSR USR-W610 RS232/485 to Wi-Fi/Ethernet Converter (firmware containing the embedded credentials)
Industrial deployments using the USR-W610 as a serial-to-network gateway
OT and ICS environments relying on the device for RS232/RS485 bridging

Discovery Timeline

2026-05-29 - CVE-2026-7786 published to NVD
2026-06-01 - Last updated in NVD database
2026-06-04 - EPSS scoring data published

Technical Details for CVE-2026-7786

Vulnerability Analysis

The USR-W610 firmware image ships with administrative credentials stored in plaintext within the binary. An attacker who obtains a copy of the firmware, either by downloading it from the vendor portal or by extracting it from a physical device, can recover these credentials using standard reverse-engineering tools such as binwalk, strings, and filesystem unpackers. Once recovered, the credentials authenticate against the device's management interfaces over the network.

The issue is classified under [CWE-798] Use of Hard-coded Credentials. Because the same credentials are present in every firmware image of the affected version, a single extraction yields universal access to all deployed devices running that firmware.

Root Cause

The root cause is a design decision to embed administrative authentication material directly in the firmware image rather than provisioning per-device credentials or requiring a first-boot password change. Static credentials in firmware cannot be rotated by operators without a vendor firmware update and are recoverable by anyone who can read the firmware binary.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker on the same network as the device, or with routed access to its management services, can authenticate using the extracted credentials. Successful authentication grants administrative control over the converter, enabling configuration changes, interception of serial traffic, lateral movement into connected OT segments, and disruption of industrial processes that depend on the RS232/RS485 bridge.

No verified public exploit code is required beyond the extracted credentials themselves. See the CISA ICS Advisory ICSA-26-148-02 and the GitHub CSAF Data File for the authoritative advisory content.

Detection Methods for CVE-2026-7786

Indicators of Compromise

Successful administrative logins to USR-W610 management services from unexpected source addresses or outside maintenance windows.
Unscheduled configuration changes, firmware updates, or new serial-tunneling sessions originating from the device.
Outbound connections from the converter to untrusted hosts on the internet or other network segments.

Detection Strategies

Inspect firmware images of deployed USR-W610 units with tools like binwalk and strings to confirm the presence of embedded credentials.
Monitor authentication events on the device's web and Telnet management interfaces for logins using the default or known embedded credentials.
Use network sensors to flag management-protocol traffic to USR-W610 IPs from any source outside an approved engineering workstation list.

Monitoring Recommendations

Log all administrative sessions to the USR-W610 and forward them to a central SIEM for correlation with change-control records.
Baseline expected serial-over-IP traffic patterns and alert on deviations such as new destination IPs or protocol changes.
Track firmware version inventory across the OT fleet to identify devices still running the vulnerable firmware.

How to Mitigate CVE-2026-7786

Immediate Actions Required

Place affected USR-W610 devices on isolated management VLANs accessible only from designated engineering workstations.
Block all internet-facing exposure of USR-W610 management interfaces at the perimeter firewall.
Inventory all USR-W610 units and identify those running the affected firmware for prioritized remediation.
Rotate any shared secrets, certificates, or credentials that may have transited the converter while it was exposed.

Patch Information

No fixed firmware version is listed in the NVD record at publication. Consult the CISA ICS Advisory ICSA-26-148-02 and the vendor for current remediation status and any updated firmware releases that remove the embedded credentials.

Workarounds

Restrict access to the device's HTTP, Telnet, and other management services using ACLs that permit only authorized engineering hosts.
Deploy the converter behind a VPN or jump host so management traffic never traverses untrusted networks.
Disable any management services that are not required for the deployment to reduce the attackable surface.
Apply network segmentation between the OT segment hosting the converter and corporate IT networks per CISA defense-in-depth guidance.

bash

# Example: restrict management access to USR-W610 with iptables on an upstream gateway
# Replace 10.10.20.5 with the converter IP and 10.0.50.0/24 with the engineering subnet
iptables -A FORWARD -p tcp -d 10.10.20.5 --dport 80  -s 10.0.50.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.10.20.5 --dport 23  -s 10.0.50.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.10.20.5 --dport 80  -j DROP
iptables -A FORWARD -p tcp -d 10.10.20.5 --dport 23  -j DROP