CVE-2026-7786 identifies a critical vulnerability in the firmware of the USR-W610 RS232/485 to Wi-Fi/Ethernet Converter by Jinan USR IOT Technology Limited. The device firmware includes plaintext administrative credentials embedded within the firmware image. An attacker with access to the firmware can extract these credentials and use them to authenticate to device services without authorization. This vulnerability is categorized under CWE-798 (Use of Hard-coded Credentials) and has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. The affected firmware version is 7.03T.07. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to gain unauthorized administrative access to the device by using embedded plaintext credentials. This can lead to full compromise of device functions, including potential control over network communications and connected systems. The vulnerability impacts confidentiality, integrity, and availability at a critical level as indicated by the CVSS score of 9.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to firmware images and device management interfaces to trusted personnel only. Monitoring for firmware updates from Jinan USR IOT Technology Limited is recommended to apply any future patches promptly.