The vulnerability resides in the web management interface of the Jinan USR IOT Technology Limited USR-W610. Administrators can set the default username and password to blank, which results in the device allowing authentication with empty credentials via the web interface and Telnet. This means any user who can reach those ports can gain full administrative control, effectively bypassing the entire authentication mechanism. Identified as CWE‑521.

Affected hardware is the USR‑W610 industrial control device from Jinan USR IOT Technology Limited. The product is end‑of‑life, and no vendor patch is available. Because the device still supports the vulnerable configuration, any installed unit remains exposed if left unchanged.

The CVSS score is 9.8, indicating critical severity, while the EPSS score is less than 1 %. Even with low exploit probability, the combination of high impact and possible network‑adjacent exploitation means that an attacker with access to the local network can immediately establish administrative command and control. The vulnerability is not listed in KEV, but the lack of a fix means operators must take immediate defensive action such as disabling exposed services or replacing the device.