CVE-2026-7786 describes a critical vulnerability in the USR-W610 RS232/485 to Wi-Fi/Ethernet Converter firmware version 7.03T.07 by Jinan USR IOT Technology Limited. The device firmware contains hardcoded plaintext administrative credentials, which can be extracted through firmware analysis. This exposure allows an attacker to authenticate to device services without authorization. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials) and has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. No vendor-provided patch or mitigation is currently documented.

An attacker who obtains the firmware image can extract embedded plaintext administrative credentials and use them to gain unauthorized access to device services. This compromises device confidentiality, integrity, and availability, potentially allowing full control over the affected device. Given the critical CVSS score of 9.8, the impact is severe. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting firmware access, isolating affected devices within secure network segments, and monitoring for unauthorized access attempts. Avoid deploying affected firmware versions in sensitive environments where possible.