CVE-2026-7786Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter device firmware contains plaintext administrative credentials embedded in the firmware image. These credentials can be extracted through firmware analysis and used to authenticate to device services.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-798

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

4 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-05-31); latest day: 1
4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-30	1	Disclosure1
2026-05-31	2	Disclosure2
2026-09-02	1	General1

Full discourse4 posts

UNDERCODE TESTING@UndercodeUpdate41d
General
🚨 #CVE-2026-7786: From Hardware Attack Surface to Internet-Facing Attack Surface — A Deep Dive into #IoT/Embedded Reconnaissance & Attack Surface Management + Video -Prediction: 📈 3 Positive | 📉 2 Negative https://undercodetesting.com/cve-2026-7786-from-hardware-attack-surface-to-internet-facing-attack-surface-a-deep-dive-into-iot-embedded-reconnaissance-attack-surface-management-video/ Educational Purposes!
Post summary
The tweet references CVE‑2026‑7786 and links to a deep‑dive article, but it provides no direct evidence of PoC, exploit, active attacks, or patch information.
0000053
720 followersView on X
Infoflowcloud@infoflowcloud135d
Disclosure
🚨*CVE* CVE-2026-7786 Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter device firmware contains plaintext administrative credentials embedded in the fir… https://www.cve.org/CVERecord?id=CVE-2026-7786 ----- Traducción: CVE-2026-7786 Jin… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑7786, noting plaintext admin credentials embedded in the firmware of the USR‑W610 converter, but provides no PoC, exploit, patch, or evidence of active exploitation.
0000041
79 followersView on X
CVE@CVEnew135d
Disclosure
CVE-2026-7786 Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter device firmware contains plaintext administrative credentials embedded in the fir… https://www.cve.org/CVERecord?id=CVE-2026-7786
Post summary
The text announces CVE‑2026‑7786, noting that the firmware of the USR‑W610 converter includes plaintext administrative credentials. It provides a vulnerability detail but no PoC, exploit, active use, or patch information.
00000241
57.6K followersView on X
Upwind Security MDR@UpwindMDR136d
Disclosure
🚨Critical - USR-W610 Hardcoded Plaintext Administrative Credentials (CVE-2026-7786) The firmware of the Jinan USR IOT USR-W610 RS232/485 to Wi-Fi/Ethernet Converter contains hard-coded plaintext administrative credentials. These credentials are easily extractable through firmware analysis and can be used by attackers to gain full administrative access to the device. This critical vulnerability (CVSS 9.8) allows unauthenticated remote attackers who obtain the firmware to completely compromise the converter.
Post summary
The text discloses a critical flaw in the USR-W610 converter firmware that hard‑codes administrative credentials, enabling attackers to obtain full administrative access.
0000081
196 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-7786

Upwind Security MDR[verified]@UpwindMDRDisclosure

The text discloses a critical flaw in the USR-W610 converter firmware that hard‑codes administrative credentials, enabling attackers to obtain full administrative access.

UNDERCODE TESTING@UndercodeUpdateGeneral

The tweet references CVE‑2026‑7786 and links to a deep‑dive article, but it provides no direct evidence of PoC, exploit, active attacks, or patch information.

Infoflowcloud@infoflowcloudDisclosure

The tweet announces CVE‑2026‑7786, noting plaintext admin credentials embedded in the firmware of the USR‑W610 converter, but provides no PoC, exploit, patch, or evidence of active exploitation.

CVE@CVEnewDisclosure

The text announces CVE‑2026‑7786, noting that the firmware of the USR‑W610 converter includes plaintext administrative credentials. It provides a vulnerability detail but no PoC, exploit, active use, or patch information.