CVE-2026-25715 — AI Deep Analysis Summary

🚨 **Essence**: The USR-W610 allows setting admin username/password to **empty strings**. 💀 **Consequences**: Attackers gain **full administrative control** without credentials.…

🛡️ **Root Cause**: **CWE-521** (Weak Password Requirements). The system fails to enforce non-empty credentials for the admin account. A basic input validation flaw.

🏭 **Affected**: Jinan USR IOT **USR-W610** (Serial-to-Ethernet Converter). Vendor: **Jinan USR IOT Technology Limited**. Specific versions not listed, assume all current firmware.

🔓 **Attacker Actions**: Gain **Full Admin Privileges**. No authentication required. Can modify device config, intercept data, or pivot to internal networks. Total compromise.

📉 **Exploitation**: **LOW** threshold. **Network Accessible** (AV:N). **Low Complexity** (AC:L). **No Privileges** needed (PR:N). **No User Interaction** (UI:N). Extremely easy to exploit.

💻 **Public Exploit**: **No** specific PoC code provided in data. However, the flaw is logical (empty password). Exploitation is trivial for any attacker with network access.

🔍 **Self-Check**: Scan for USR-W610 devices. Attempt login with **blank username/password**. Check if the device accepts empty credentials for admin access. Use CVSS vector analysis.

🩹 **Official Fix**: **Yes**. CISA Advisory **ICSA-26-050-03** issued. Vendor likely released a patch enforcing password complexity. Check vendor site for updates.

🚧 **No Patch Workaround**: **Enforce strong passwords** immediately via configuration. If possible, restrict network access to the device. Disable remote admin if feasible.

⚡ **Urgency**: **CRITICAL**. CVSS Score is **9.1 (High)**. Remote, unauthenticated, full control. Patch immediately. Prioritize for OT/ICS environments.