# Hard-coded Credentials in PUSR Industrial Converter Enable Complete Device Takeover


## The Threat


The USR-W610 RS232/485 to Wi-Fi/Ethernet Converter, manufactured by Jinan USR IOT Technology Limited (PUSR), contains embedded administrative credentials that can be extracted directly from the firmware image. An attacker with access to the device firmware—obtainable through physical access, network interception, or firmware repositories—can extract plaintext credentials and use them to authenticate as an administrator. Once authenticated, the attacker gains full control of the device.


The USR-W610 is a network bridge commonly deployed in industrial and critical infrastructure environments to convert legacy RS232/485 serial communications to modern Ethernet and Wi-Fi protocols. These devices are invisible infrastructure: they sit in manufacturing plants, utility control rooms, and process automation systems, translating signals between older equipment and modern networks. The presence of hard-coded administrative credentials means any attacker who obtains the firmware can assume complete control without needing to crack passwords or exploit additional vulnerabilities.


This is a critical failure in the device's security foundation. The vulnerability is not a complex logic flaw requiring specialized knowledge to exploit—it is a fundamental misunderstanding of how to handle credentials. Hard-coded credentials in firmware have been a known anti-pattern in industrial security for over two decades. The presence of this vulnerability suggests the device was never subjected to basic firmware security review before release.


## Severity and Impact


| Field | Value |

|-------|-------|

| CVE | CVE-2026-7786 |

| CVSS v3.1 Score | 9.8 (CRITICAL) |

| Base Severity | CRITICAL |

| Vector String | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |

| Attack Vector | Network |

| Attack Complexity | Low |

| Privileges Required | None |

| User Interaction | None |

| Scope | Unchanged |

| Confidentiality | High |

| Integrity | High |

| Availability | High |

| CWE | CWE-798: Use of Hard-coded Credentials |


The CVSS 9.8 rating reflects the severity: an attacker can exploit this vulnerability remotely, requires no privileges or user interaction, and gains complete control over device administration. The device typically controls legacy equipment in manufacturing and utility environments, meaning successful exploitation could disrupt production, compromise safety systems, or alter operational parameters in critical infrastructure.


## Affected Products


Jinan USR IOT Technology Limited (PUSR)

  • USR-W610 RS232/485 to Wi-Fi/Ethernet Converter version 7.03T.07

    • ## Mitigations


    Network Segmentation and Access Control


    Since PUSR did not respond to CISA coordination attempts and no firmware patch is available, organizations must implement strict network controls:


  • Isolate all USR-W610 devices on a dedicated, air-gapped network segment separate from business networks
  • Implement strict firewall rules to prevent any internet-facing exposure of these devices
  • Restrict administrative access to the devices using network access controls (ACLs) and VLANs
  • Deploy network monitoring to detect unauthorized configuration changes or administrative logins

    • Secure Remote Access


  • If remote access to these devices is required, use a Virtual Private Network (VPN) with current, patched clients and servers
  • Implement multi-factor authentication on VPN access
  • Use jump hosts or bastion servers with logging and monitoring for any remote access attempts
  • Change default network passwords on the device if they differ from the extracted administrative credentials

    • Firmware Handling


  • Store firmware images securely and restrict access to authorized personnel only
  • Avoid downloading or storing firmware in locations accessible to network-connected systems
  • If the device must be configured or updated, do so only on isolated networks with no internet connectivity

    • Detection and Response


  • Monitor device logs for unexpected administrative logins or configuration changes
  • Implement network-based intrusion detection to flag unauthorized access attempts to these devices
  • Establish incident response procedures for suspected compromise of these devices, including immediate isolation and forensic analysis

    • Vendor Engagement


  • Contact PUSR to inquire about firmware patches and end-of-life timelines
  • Consider replacing affected devices with equipment from vendors with documented security practices
  • For legacy systems where replacement is not feasible, maintain compensating controls with network isolation and monitoring

    • ## References


  • [CISA Industrial Control Systems Advisories](https://www.cisa.gov/news-events/alerts-advisories)
  • [CVE-2026-7786 - Hard-coded Credentials in PUSR USR-W610](https://www.cisa.gov/vulnerabilities)
  • [CISA ICS Security Recommended Practices](https://www.cisa.gov/ics)
  • [Defense-in-Depth Strategies for ICS Cybersecurity](https://www.cisa.gov/ics)

    • ## HackWire Analysis


    This vulnerability exposes a persistent problem in industrial IoT: manufacturers continue to ship devices with hard-coded credentials despite two decades of security best practices. The USR-W610 is not alone—similar serial-to-Ethernet converters from other vendors have carried identical flaws. What makes CVE-2026-7786 noteworthy is that PUSR did not respond to CISA's coordination attempts, meaning organizations cannot expect a patch. The device is stranded in an unpatched state with no path to remediation.


    The real story here is the lack of accountability. PUSR manufactures devices deployed globally in manufacturing, energy, and process control systems. The hard-coded credentials suggest no firmware security review occurred before release. CISA disclosed this vulnerability because public safety demanded it—but organizations are now left implementing workarounds to compensate for vendor negligence.


    For defenders, this is a hard lesson: assume devices you cannot patch will be exploited. The absence of public exploitation today does not mean it won't happen tomorrow. Industrial devices with direct remote access are high-value targets. An attacker who compromises a serial-to-Ethernet converter can modify operational data, trigger false alarms, or disable safety interlocks depending on what equipment the device controls.


    Organizations using these converters should audit their deployments immediately. If the device is exposed to any network (even behind a firewall), isolation should begin today. If replacement is infeasible, layered controls—network segmentation, anomaly detection, and strict access logging—are the only defense against an eventually inevitable attack. PUSR's non-response to CISA suggests little confidence in a security fix. Treat it as permanent and plan accordingly.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)