CVE-2026-25715 Jinan USR IOT Technology Limited (PUSR) CVE debrief

Who should care

OT/ICS operators, plant engineers, network security teams, and asset owners responsible for PUSR USR-W610 deployments or any exposed web/Telnet management paths.

Technical summary

The issue is an authentication failure in device management: the product permits administrator username and password fields to be set to blank values, and those empty credentials are then accepted for access. The exposure affects web management and Telnet, so a network-adjacent attacker can reach administrative functions without valid credentials if the service is reachable. The advisory lists the product as end-of-life, which removes the option of a vendor patch and increases reliance on segmentation, service restriction, and replacement planning.

Defensive priority

Critical. This is a complete management-authentication failure on an end-of-life device, with no planned vendor fix and a high likelihood of administrative takeover if management services are reachable.

Recommended defensive actions

• Inventory all PUSR USR-W610 devices and confirm whether any are running version 3.1.1.0 or earlier.
• Restrict web management and Telnet to trusted administration networks only; block access from user, guest, and broader operational segments.
• Disable Telnet and any unnecessary remote management exposure where operationally possible.
• Verify that no device is configured with blank administrator credentials, and review management access paths for unintended reachability.
• Place affected devices behind compensating controls such as network segmentation, jump hosts, and strict allowlists.
• Plan replacement or migration for the end-of-life product, since the advisory states no patch is planned.

Evidence notes

The source corpus is a CISA CSAF advisory (ICSA-26-050-03) published on 2026-02-19, the same date as the CVE record and source item. The advisory text explicitly states that blank admin credentials are accepted over the web interface and Telnet, and that PUSR has said the product is end-of-life with no planned patch. The corpus also marks the vendor/product identity with low confidence and requests review, so product naming should be treated cautiously while the advisory itself remains authoritative.

Official resources