The firmware of the Jinan USR IOT Technology Limited (PUSR) USR‑W610 RS232/485 to Wi‑Fi/Ethernet Converter contains plaintext administrative credentials that can be extracted by analyzing the firmware image. An attacker who obtains these credentials can authenticate as an administrator to device services, gaining full control over configuration and operation. This compromise enables an unauthorized user to change settings, exfiltrate data, and potentially pivot to other assets on the network.

Jinan USR IOT Technology Limited (PUSR) USR‑W610 RS232/485 to Wi‑Fi/Ethernet Converter. No specific firmware versions are listed, so all current builds of this device are potentially affected.

The CVSS score of 9.8 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so no known exploits are reported. However, the presence of hard‑coded credentials means that exploitation is straightforward for anyone who can access the firmware or connect to the device’s management interface. The likely attack vectors include downloading the firmware for analysis or directly accessing the device over its network interface, where the hard‑coded username and password are accepted without further verification.