CVE-2026-73819

The vendor configuration utility for the Ebyte NA111-M grants access to administrative functions without verifying the operator's identity under certain credential conditions, an issue classified as weak authentication (CWE-1390). An unauthenticated attacker positioned on the adjacent network can reach the utility and invoke these administrative functions without valid credentials. By doing so, the attacker can modify critical device settings or change access credentials, which could lock legitimate administrators out of the device. Deployments of the affected Ebyte product in which the configuration interface is reachable from an adjacent network are at risk. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known; EPSS currently estimates only a 0.5% probability of exploitation in the next 30 days, although the CVSS 4.0 score of 9.3 (critical) reflects high potential impact.

What to do: Restrict access to the NA111-M's configuration utility to trusted management segments (e.g., VLANs, ACLs, or firewall rules) so that adjacent-network attackers cannot reach the interface, and monitor devices for unexpected configuration or credential changes. Check the CISA ICS-CERT advisory and Ebyte's release notes for patched firmware or configuration-utility versions, and apply the vendor's fix as soon as it is identified. If remote administration is not required, disable or firewall the configuration interface until an update is applied.