CVE-2026-69658

The Ebyte NA111-M transmits MQTT credentials and control traffic over the network without encryption, a cleartext transmission flaw (CWE-319). An attacker positioned on the network path — for example, on the same LAN or a listening segment between the device and its MQTT broker — can passively capture these credentials and observe or intercept control messages. With harvested credentials, an attacker can impersonate a legitimate device on the broker, inject or disrupt messaging, and gain high confidentiality, integrity, and availability impact on the affected device (CVSS 4.0 score 9.3). Users of the NA111-M module in industrial or IoT deployments where MQTT traffic crosses untrusted network segments are affected. No public proof-of-concept, known exploitation, or KEV listing exists, and EPSS puts 30-day exploitation probability at about 0.2%.

What to do: Inventory deployments of the NA111-M and identify any that use cleartext MQTT (default port 1883) across untrusted or shared network segments; switch to TLS-encrypted MQTT (port 8883) if the module firmware supports it. Isolate MQTT traffic with network segmentation or firewall rules restricting which hosts can reach the broker, and rotate any MQTT credentials that may have traversed exposed links. Monitor CISA ICS advisories and the vendor's channel for firmware updates addressing cleartext transmission.