USR-W610
From Wiki-IoT
Device Overview
- Manufacturer: USR (PUSR)
- Model Number: USR-W610
- Firmware Versions affected: All versions before patch release
- Use-case: Industrial RS232/485 to WiFi/Ethernet converter, used for sensor and PLC data transmission.
Vulnerabilities & Attack Surface
- CVE ID: CVE-2026-7786
- Vulnerability description: Hardcoded plaintext administrator credentials stored inside firmware. Attackers who extract firmware can log in arbitrarily.
- Attack vector: Network / firmware dump.
CIA Triad Impact Analysis
- Confidentiality: Serial port data, Modbus sensor readings and device configuration are exposed.
- Integrity: Attackers can modify serial forwarding rules and network parameters.
- Availability: Malicious configuration can break communication between industrial sensors and host.
Mitigations / Countermeasures
- 1. Upgrade to patched firmware version.
- 2. Deploy the converter inside isolated industrial VLAN.
- 3. Change login password immediately after deployment.
- 4. Block internet inbound access to the web management page.
References
[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7786 [2] USR IoT security advisory
