The embedded web interface of the device does not support HTTPS/TLS for authentication and instead uses HTTP Basic Authentication; traffic is merely encoded, not encrypted, exposing user credentials to passive network sniffing. This flaw, identified as CWE‑319, allows an attacker capable of eavesdropping on the local network to capture account names and passwords, potentially granting unauthorized control of the device's functions and the sensitive data it manages.

The vulnerability impacts the Jinan USR IOT Technology Limited (PUSR) USR‑W610 devices. No specific firmware or build numbers are listed, and the product is listed as end‑of‑life by the vendor, which implies no forthcoming patches will be released.

With a CVSS score of 7.5, the severity is high. The EPSS score is listed as < 1 %, indicating a low probability of exploitation in the wild, and the vulnerability is not catalogued in the CISA KEV list. The likely attack vector is passive interception on the same local network; an adversary does not need to execute code but must be able to sniff network traffic. While the immediate threat is credential disclosure, compromised credentials could lead to broader compromise of connected systems. Overall the risk remains moderate to high for networks that are not properly segmented or isolated.