Critical Vulnerabilities Exposed in USR-W610 IoT Devices by Jinan USR IOT

Critical Flaws Discovered in Jinan USR IOT’s USR-W610 Devices

Madrid, Spain – February 20, 2026 – INCIBE-CERT has issued an urgent security advisory regarding multiple high-severity vulnerabilities in the USR-W610, an industrial IoT device manufactured by Jinan USR IOT Technology Limited. These flaws could allow threat actors to execute remote code, bypass authentication, or gain unauthorized access to affected systems.

Technical Details of the Vulnerabilities

While specific CVE IDs have not been disclosed in the advisory, INCIBE-CERT highlights the following critical risks:

• Remote Code Execution (RCE): Unauthenticated attackers may exploit flaws in the device’s firmware or network services to execute arbitrary commands with elevated privileges.
• Authentication Bypass: Weak or hardcoded credentials could enable unauthorized access to the device’s administrative interface.
• Information Disclosure: Sensitive data, including configuration files or network traffic, may be exposed due to improper input validation or insecure storage practices.
• Denial-of-Service (DoS): Vulnerabilities in network protocols or service handling could allow attackers to crash or disrupt device functionality.

The USR-W610 is a widely deployed industrial IoT gateway used for remote monitoring, data acquisition, and edge computing in sectors such as manufacturing, energy, and critical infrastructure. Its exposure to these vulnerabilities poses significant risks to operational continuity and data integrity.

Impact Analysis

Successful exploitation of these vulnerabilities could lead to:

• Unauthorized control of industrial processes or IoT ecosystems.
• Data breaches involving sensitive operational or configuration data.
• Network propagation of attacks, potentially compromising connected systems.
• Operational disruptions in critical infrastructure environments.

Given the device’s prevalence in industrial settings, INCIBE-CERT urges organizations to prioritize remediation to mitigate potential cascading effects on interconnected systems.

Recommendations for Security Teams

INCIBE-CERT advises the following immediate actions:

1. Apply Patches: Check for firmware updates from Jinan USR IOT Technology Limited and apply them without delay. Monitor the vendor’s official channels for security advisories.
2. Network Segmentation: Isolate USR-W610 devices from corporate networks and critical systems to limit lateral movement in the event of a breach.
3. Access Controls: Enforce strong, unique credentials for device administration and disable default or hardcoded passwords.
4. Monitoring: Deploy intrusion detection/prevention systems (IDS/IPS) to detect anomalous traffic or exploitation attempts targeting the USR-W610.
5. Vulnerability Scanning: Conduct regular scans to identify exposed or unpatched devices within your infrastructure.
6. Incident Response: Prepare a response plan for potential breaches, including device isolation and forensic analysis.

For further details, refer to the original advisory published by INCIBE-CERT.

---

Stay updated on emerging threats with INCIBE-CERT’s alerts and advisories.