CVE-2026-7786 Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter Use of Hard-coded Credentials
Attackers can extract plaintext admin credentials from firmware to gain unauthorized access to the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-7786?
CVE-2026-7786 is a critical vulnerability in Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter, published on 29 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter device firmware contains plaintext administrative credentials embedded in the firmware image. These credentials can be extracted through firmware analysis and used to authenticate to device services.
Weakness: CWE-798
Which versions are affected by CVE-2026-7786?
How do I fix CVE-2026-7786?
No fix has been published for CVE-2026-7786 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-7786 being exploited?
There is no known exploitation of CVE-2026-7786 in the wild and no public exploit code.
Sources
Also known as GHSA-79x3-xvpv-235q.