Plaintext password rendering in PUSR USR-W610 web management UI

Exposure of valid administrative credentials to unauthorized observers (e.g., shoulder surfing, screenshots, or browser caching), which can enable subsequent unauthorized administrative access if the captured credentials are reused to authenticate to the device’s management interface.

Restrict access to the web management interface to trusted administrators only (e.g., management VLAN/VPN, IP allowlisting, segmentation) and enforce physical/operational controls to prevent observation (no screen sharing/screenshots during admin sessions). Use hardened/admin-only browsers and policies to reduce caching/autofill/password-saving for the management UI, and rotate potentially exposed passwords; enable MFA if the platform supports it.

Apply a vendor firmware update/fix (when available) that prevents displaying the current password in cleartext and uses a masked password input control (e.g., HTML input type="password") and appropriate no-store/no-autofill controls. Rotate administrative credentials after any session where exposure may have occurred.