CVE-2026-73809

CVE-2026-73809 is a cleartext transmission flaw (CWE-319) in the web management interface of certain Ebyte gateway products, with the NA111-M model named in related coverage, that fails to protect sensitive communications with transport-layer encryption. It is triggered when a user interacts with the device's management web pages over an unencrypted connection, allowing anyone positioned to observe network traffic to intercept authentication or session-related information. An attacker who captures this data gains disclosure of sensitive information and can use it to obtain unauthorized access to the device's management functionality, reflected in the high confidentiality impact in the 8.7 (High) CVSS 4.0 score. Operators of affected Ebyte gateways, typically deployed in industrial and IoT networking environments, are exposed, although the available data specifies no version range. There is currently no evidence of active exploitation: the flaw is not in CISA's Known Exploited Vulnerabilities catalog, has no public proof-of-concept, and carries a low EPSS probability of 0.2%.

What to do: Do not expose the device's web management interface to untrusted networks; access it only over a trusted LAN, VPN, or encrypted tunnel, and restrict management access with firewall/ACL rules. Check the Ebyte advisory and the associated CISA ICS advisory for the full list of affected models and fixed firmware, and apply the vendor's update when available. Because credentials may have been captured in cleartext, change device management passwords after enabling protected access.