The web management interface of the PUSR USR‑W610 device displays the current administrator password in a plaintext input field. An individual with access to the interface can observe the entire password, exposing credentials to shoulder‑surfing attacks, screenshots, or browser form caching. This vulnerability allows malicious actors to obtain valid authentication credentials, potentially enabling unauthorized configuration changes or network access if the credentials are used elsewhere.

This issue affects the PUSR USR‑W610 model produced by Jinan USR IOT Technology Limited. No specific firmware or hardware revision numbers are provided, so all units of this model are considered vulnerable.

The vulnerability carries a CVSS score of 5.7, indicating moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed public exploits. The likely attack vector is local to anyone who can access the device’s management interface, either physically or over a network where the UI is reachable. Due to the lack of a vendor patch and the device’s end‑of‑life status, the risk persists until mitigated by configuration changes or device replacement.