CVE-2026-77975

The affected Ebyte device, identified in related reporting as the NA111-M, exports administrative credentials and other sensitive configuration information without adequate protection (cleartext storage of sensitive information, CWE-312). An unauthenticated attacker positioned on the adjacent network who can obtain an exported configuration file can recover the stored credentials and use them to authenticate to the device. Because credentials may be reused, the attacker could also gain access to similarly configured systems in the deployment. Any site operating the affected Ebyte product, particularly industrial or IoT deployments where configuration files are exchanged or archived, is potentially affected. No public proof-of-concept, CISA KEV listing, or known exploitation exists; EPSS estimates only a 0.2% chance of exploitation in the next 30 days.

What to do: Restrict access to exported configuration files, rotate administrative credentials on any device whose configuration export has been shared or stored, and segment networks to limit adjacent-network access to device management interfaces. Monitor CISA ICS-CERT and vendor advisories for confirmed affected firmware ranges and apply the fixed firmware as soon as it is published.