Jinan USR IOT Technology Limited (PUSR) USR-W610 Missing Authentication for Critical Function
The Wi-Fi router is vulnerable to de-authentication attacks due to the
absence of management frame protection, allowing forged deauthentication
and disassociation frames to be broadcast without authentication or
encryption. An attacker can use this to cause unauthorized disruptions
and create a denial-of-service condition.
Jinan USR IOT Technology Limited (PUSR) has stated that the product is
end-of-life, and there are no plans to patch. Users of PUSR USR-W610
devices are encouraged to contact PUSR and keep their systems up to date.
Exploits
Credits
finder
Abhishek Pandey and Ranit Pradhan of Payatu Security Consulting reported this to CISA.