Jinan USR IOT Technology Limited USR-W610 Web Interface Authentication Vulnerability

A vulnerability exists in the embedded web interface of the Jinan USR IOT Technology Limited (PUSR) USR-W610 device, specifically in versions through 3.1.1.0. The issue arises because the web interface does not support HTTPS/TLS for authentication, relying instead on HTTP Basic Authentication. While the traffic is encoded, it is not encrypted, leaving user credentials, including those of administrators, exposed to passive interception by attackers on the same network.

Impact

Exploitation of this vulnerability allows for the interception of user credentials, including administrator rights, during transmission over the network.

Remediation

Jinan USR IOT Technology Limited (PUSR) has declared the USR-W610 product end-of-life and has no plans to issue a patch. Users are advised to contact PUSR and keep their systems updated.