CVE-2026-73125

The web management interface of Ebyte devices, with the NA111-M the model named in related coverage, does not consistently enforce authentication before granting access to administrative functionality (CWE-306, Missing Authentication for Critical Function). Because the flaw requires no privileges or user interaction and is reachable over the network (CVSS 4.0 network vector, scored 9.3 critical), an unauthenticated remote attacker who can reach the web interface can invoke administrative functions directly. On success, the attacker gains access to sensitive configuration information, the ability to modify device settings, and the ability to disrupt device availability, with high impact on the affected device itself per the CVSS scoring. Any deployment of the affected Ebyte devices is exposed, with the greatest risk where the management interface is reachable from untrusted networks; specific affected model/version ranges were not provided in the available data, so operators should scope against the CISA ICS-CERT advisory. No public proof-of-concept is known, the issue is not in the CISA KEV catalog, and EPSS assigns a 0.5% (43rd percentile) probability of exploitation within 30 days, so exploitation has not been observed.

What to do: Restrict access to the device web management interface using firewall rules, ACLs, or a VPN so it is not reachable from untrusted networks, and check whether the interface serves administrative pages without login (e.g., browsing to it in a fresh session without authenticating). Because affected version ranges were not provided in the available data, monitor the CISA ICS-CERT advisory and Ebyte releases for a firmware update and apply it when published.