CVE-2026-25715Disclosure

MEDIUMCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively disables authentication across all critical management channels, allowing any network-adjacent attacker to gain full administrative control without credentials.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-521

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
12 mentions across 4 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 10 signals
Disclosure: 7 classified signals
General: 2 classified signals
Peaked 3d ago at 4 mentions (2026-02-20); latest day: 2
12 total mentions across 4 days

Deep dive

Activity timeline12 mentions / 4d

Signal classification4 categories

Disclosure

758.3%

General

216.7%

Patch

216.7%

Active Exploitation

18.3%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-20	4	Disclosure4
2026-02-24	2	General1Patch1
2026-02-25	4	Disclosure2General1Patch1
2026-02-26	2	Active Exploitation1Disclosure1

Full discourse12 posts

Gray Hats@the_yellow_fall229d
Patch
CISA warns of critical flaws in EOL USR-W610 IoT servers. CVE-2026-25715 allows full admin control via blank passwords. No patches planned; isolate now. #USR610 #CISA #IoT #CyberSecurity #IndustrialSecurity #InfoSec #Vulnerability #PatchAlert https://securityonline.info/no-patch-for-the-eol-cisa-warns-of-critical-9-8-severity-flaw-in-usr-w610-iot-devices/
Post summary
CISA warns of a critical flaw (CVE-2026-25715) in EOL USR‑W610 IoT servers that permits full admin control via blank passwords; no patches are planned, so devices should be isolated.
11031402
10.4K followersView on X
The Hacker Wire@TheHackerWire232d
Disclosure
🔴 CVE-2026-25715 - Critical The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentia... https://www.thehackerwire.com/vulnerability/CVE-2026-25715/ https://t.co/zpOXHqr0Gu
Post summary
CVE-2026-25715 allows authentication bypass by setting empty admin credentials; the vulnerability is disclosed without mention of PoC, exploit code, active use, or available patch.
0000161
112 followersView on X
mysocAi@MysocAi227d
Active Exploitation
[CRITICAL] CVE-2026-25715: Critical Authentication Bypass CVE-2026-25715 allows unauthenticated access; critical flaw in web management interface. CVE: CVE-2026-25715 • APT: N/A • Status: ACTIVE EXPLOITATION OBSERVED … https://www.thehackerwire.com/vulnerability/CVE-2026-25715/
Post summary
CVE-2026-25715 is a critical authentication bypass that allows unauthenticated access to the web management interface and is actively being exploited in the wild.
000000
3 followersView on X
mysocAi@MysocAi227d
Disclosure
[CRITICAL] CVE-2026-25715: Critical Authentication Bypass Flaw Critical vulnerability allows unauthenticated access to device management interfaces. CVE: CVE-2026-25715 • APT: Unknown • Status: ACTIVE Enables full ad… https://www.thehackerwire.com/vulnerability/CVE-2026-25715/
Post summary
A critical authentication bypass flaw (CVE-2026-25715) permits unauthenticated access to device management interfaces, but no PoC, exploit, or patch details are provided.
000005
3 followersView on X
VulnTracker@vuln_tracker228d
General
@TheHackersNews Thanks for sharing, we collected all the information about this CVE here: https://vulntracker.io/cves/CVE-2026-25715
Post summary
The tweet merely directs readers to a link for more information on CVE-2026-25715, without offering any details on exploitation, patches, or technical specifics.
0000060
340 followersView on X
mysocAi@MysocAi228d
Disclosure
[CRITICAL] CVE-2026-25715: Critical Vulnerability Discovered CVE-2026-25715 allows unauthenticated access with empty credentials, leading to full system compromise. CVE: CVE-2026-25715 • APT: Unknown • Status: ACTIVE … https://www.thehackerwire.com/vulnerability/CVE-2026-25715/
Post summary
A new critical vulnerability, CVE-2026-25715, has been disclosed, allowing unauthenticated access with empty credentials and full system compromise, but no PoC, exploit, patch, or active exploitation details are provided.
000001
3 followersView on X
mysocAi@MysocAi228d
Patch
[CRITICAL] CVE-2026-25715: Critical Authentication Bypass Vulnerability Allows unauthenticated access; CVSS 9.8; immediate patching recommended. CVE: CVE-2026-25715 • APT: Unknown • Status: ACTIVE Unauthenticated acc… https://www.thehackerwire.com/vulnerability/CVE-2026-25715/
Post summary
CVE-2026-25715 is a critical authentication bypass vulnerability (CVSS 9.8) that allows unauthenticated access; immediate patching is recommended, but no PoC or exploit details are provided.
000001
3 followersView on X
mysocAi@MysocAi228d
Disclosure
[CRITICAL] CVE-2026-25715: Critical Device Management Flaw CVE-2026-25715 allows unauthenticated access to device management interfaces. CVE: CVE-2026-25715 • APT: Unknown • Status: ACTIVE Enables full administrative… https://www.thehackerwire.com/vulnerability/CVE-2026-25715/
Post summary
The post announces CVE-2026-25715, a critical flaw that permits unauthenticated access to device management interfaces, but it does not provide a PoC, exploit code, or patch details.
000002
3 followersView on X
VulnTracker@vuln_tracker229d
General
@the_yellow_fall Thanks for sharing! We collected all the information you need about CVE-2026-25715 here: https://vulntracker.io/cves/CVE-2026-25715
Post summary
The tweet merely directs readers to a link for more information on CVE-2026-25715, without providing any specific details or claims about the vulnerability.
0000059
336 followersView on X
CVE@CVEnew232d
Disclosure
CVE-2026-25715 The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication… https://www.cve.org/CVERecord?id=CVE-2026-25715
Post summary
The note describes a new vulnerability (CVE‑2026‑25715) that permits blank admin credentials to bypass authentication in the device’s web management interface, but contains no PoC, exploit, or patch details.
00000628
56.4K followersView on X
CVETodo@CveTodo232d
Disclosure
**Key Point:** The vulnerability is rooted in the device's failure to enforce validation and restrictions on administrative credentials, leading to a scenario where "no credentials" equate to administrative access. #Cybersecurity #CVE #CriticalCVE #CriticalVulnerability #RemoteCodeExecution #AuthBypass https://cvetodo.com/cve/CVE-2026-25715
Post summary
The post announces a critical authentication bypass vulnerability (CVE‑2026‑25715) where lack of credential verification allows administrative access, potentially enabling remote code execution.
0000029
20 followersView on X
CVEFind.com@CveFindCom232d
Disclosure
[CVE-2026-25715: CRITICAL] Device web management interface vulnerability risks full administrative control without credentials due to blank username and password settings, enabling easy access for attackers.#cve,CVE-2026-25715,#cybersecurity https://cvefind.com/CVE-2026-25715
Post summary
The tweet announces CVE-2026-25715, noting that devices with blank credentials can grant attackers full admin control; no PoC, exploit tools, active exploitation, or patch details are mentioned.
0000057
578 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-25715

mysocAi[verified]@MysocAiActive Exploitation

CVE-2026-25715 is a critical authentication bypass that allows unauthenticated access to the web management interface and is actively being exploited in the wild.

mysocAi[verified]@MysocAiDisclosure

A critical authentication bypass flaw (CVE-2026-25715) permits unauthenticated access to device management interfaces, but no PoC, exploit, or patch details are provided.

VulnTracker[verified]@vuln_trackerGeneral

The tweet merely directs readers to a link for more information on CVE-2026-25715, without offering any details on exploitation, patches, or technical specifics.

mysocAi[verified]@MysocAiDisclosure

A new critical vulnerability, CVE-2026-25715, has been disclosed, allowing unauthenticated access with empty credentials and full system compromise, but no PoC, exploit, patch, or active exploitation details are provided.

mysocAi[verified]@MysocAiPatch

CVE-2026-25715 is a critical authentication bypass vulnerability (CVSS 9.8) that allows unauthenticated access; immediate patching is recommended, but no PoC or exploit details are provided.

mysocAi[verified]@MysocAiDisclosure

The post announces CVE-2026-25715, a critical flaw that permits unauthenticated access to device management interfaces, but it does not provide a PoC, exploit code, or patch details.

VulnTracker[verified]@vuln_trackerGeneral

The tweet merely directs readers to a link for more information on CVE-2026-25715, without providing any specific details or claims about the vulnerability.

CVETodo[verified]@CveTodoDisclosure

The post announces a critical authentication bypass vulnerability (CVE‑2026‑25715) where lack of credential verification allows administrative access, potentially enabling remote code execution.