AI analysis
The affected Ebyte device, identified in related reporting as the NA111-M, exports administrative credentials and other sensitive configuration information without adequate protection (cleartext storage of sensitive information, CWE-312). An unauthenticated attacker positioned on the adjacent network who can obtain an exported configuration file can recover the stored credentials and use them to authenticate to the device. Because credentials may be reused, the attacker could also gain access to similarly configured systems in the deployment. Any site operating the affected Ebyte product, particularly industrial or IoT deployments where configuration files are exchanged or archived, is potentially affected. No public proof-of-concept, CISA KEV listing, or known exploitation exists; EPSS estimates only a 0.2% chance of exploitation in the next 30 days.
What to do: Restrict access to exported configuration files, rotate administrative credentials on any device whose configuration export has been shared or stored, and segment networks to limit adjacent-network access to device management interfaces. Monitor CISA ICS-CERT and vendor advisories for confirmed affected firmware ranges and apply the fixed firmware as soon as it is published.
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The affected Ebyte product exports administrative credentials and other sensitive configuration information without adequate protection. An unauthenticated attacker on the adjacent network who can obtain an exported configuration file could recover valid credentials and use them to access the device or similarly configured systems.