Jinan USR IOT Technology Limited USR-W610 Authentication Bypass Vulnerability

A vulnerability exists in the web management interface of the Jinan USR IOT Technology Limited USR-W610 device, allowing administrators to set usernames and passwords to blank values. Once these empty credentials are applied, the device can be accessed via the web management interface and Telnet service without authentication. This flaw effectively disables authentication on critical management channels, enabling any network-adjacent attacker to gain full administrative control without credentials.

Impact

Exploitation of this vulnerability disables authentication, allowing unauthorized access to administrative controls via the web management interface and Telnet service.

Remediation

Jinan USR IOT Technology Limited has declared the USR-W610 product end-of-life and will not issue a patch. Users are advised to contact PUSR and keep their systems updated.