Ebyte NA111-M

The Ebyte NA111-M transmits MQTT credentials and control traffic over the network without encryption, a cleartext transmission flaw (CWE-319). An attacker positioned on the network path — for example, on the same LAN or a listening segment between the device and its MQTT broker — can passively capture these credentials and observe or intercept control messages. With harvested credentials, an attacker can impersonate a legitimate device on the broker, inject or disrupt messaging, and gain high confidentiality, integrity, and availability impact on the affected device (CVSS 4.0 score 9.3). Users of the NA111-M module in industrial or IoT deployments where MQTT traffic crosses untrusted network segments are affected. No public proof-of-concept, known exploitation, or KEV listing exists, and EPSS puts 30-day exploitation probability at about 0.2%.

Do: Inventory deployments of the NA111-M and identify any that use cleartext MQTT (default port 1883) across untrusted or shared network segments; switch to TLS-encrypted MQTT (port 8883) if the module firmware supports it. Isolate MQTT traffic with network segmentation or firewall rules restricting which hosts can reach the broker, and rotate any MQTT credentials that may have traversed exposed links. Monitor CISA ICS advisories and the vendor's channel for firmware updates addressing cleartext transmission.

CVE-2026-71187 is an authentication bypass (CWE-603, use of client-side authentication) in the Ebyte device identified in related coverage as the NA111-M, where the login check is performed by logic running on the client rather than being enforced and verified on the device itself. Because that client-side logic can be reproduced, an unauthenticated attacker with network reachability to the device can generate valid authentication requests and gain administrative access without knowing any credentials. Per the CVSS 4.0 base score of 9.3 (critical), the attacker obtains high confidentiality, integrity, and availability impact on the device, e.g. by reconfiguring it or disrupting its operation. Operators who deploy Ebyte NA111-M units, especially where the device's network-facing interface is reachable from an untrusted LAN segment or from the internet, are affected; the available data does not list affected firmware versions or confirm whether other Ebyte models are impacted. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS assigns a 0.5% probability of exploitation in the next 30 days (43rd percentile), so no confirmed exploitation is currently known (the CVE was assigned by CISA ICS-CERT, consistent with an industrial/IoT device).

Do: Do not expose NA111-M management interfaces directly to the internet or to untrusted LAN segments; restrict access with firewall rules or a dedicated management VLAN and review device logs for successful unauthenticated administrative logins. Check Ebyte's advisories for updated firmware addressing CVE-2026-71187 and apply it when released, since a client-side authentication flaw cannot be fully remediated by configuration alone. Follow the CISA ICS-CERT advisory for confirmed affected versions and fixed releases.

The web management interface of Ebyte devices, with the NA111-M the model named in related coverage, does not consistently enforce authentication before granting access to administrative functionality (CWE-306, Missing Authentication for Critical Function). Because the flaw requires no privileges or user interaction and is reachable over the network (CVSS 4.0 network vector, scored 9.3 critical), an unauthenticated remote attacker who can reach the web interface can invoke administrative functions directly. On success, the attacker gains access to sensitive configuration information, the ability to modify device settings, and the ability to disrupt device availability, with high impact on the affected device itself per the CVSS scoring. Any deployment of the affected Ebyte devices is exposed, with the greatest risk where the management interface is reachable from untrusted networks; specific affected model/version ranges were not provided in the available data, so operators should scope against the CISA ICS-CERT advisory. No public proof-of-concept is known, the issue is not in the CISA KEV catalog, and EPSS assigns a 0.5% (43rd percentile) probability of exploitation within 30 days, so exploitation has not been observed.

Do: Restrict access to the device web management interface using firewall rules, ACLs, or a VPN so it is not reachable from untrusted networks, and check whether the interface serves administrative pages without login (e.g., browsing to it in a fresh session without authenticating). Because affected version ranges were not provided in the available data, monitor the CISA ICS-CERT advisory and Ebyte releases for a firmware update and apply it when published.

CVE-2026-73809 is a cleartext transmission flaw (CWE-319) in the web management interface of certain Ebyte gateway products, with the NA111-M model named in related coverage, that fails to protect sensitive communications with transport-layer encryption. It is triggered when a user interacts with the device's management web pages over an unencrypted connection, allowing anyone positioned to observe network traffic to intercept authentication or session-related information. An attacker who captures this data gains disclosure of sensitive information and can use it to obtain unauthorized access to the device's management functionality, reflected in the high confidentiality impact in the 8.7 (High) CVSS 4.0 score. Operators of affected Ebyte gateways, typically deployed in industrial and IoT networking environments, are exposed, although the available data specifies no version range. There is currently no evidence of active exploitation: the flaw is not in CISA's Known Exploited Vulnerabilities catalog, has no public proof-of-concept, and carries a low EPSS probability of 0.2%.

Do: Do not expose the device's web management interface to untrusted networks; access it only over a trusted LAN, VPN, or encrypted tunnel, and restrict management access with firewall/ACL rules. Check the Ebyte advisory and the associated CISA ICS advisory for the full list of affected models and fixed firmware, and apply the vendor's update when available. Because credentials may have been captured in cleartext, change device management passwords after enabling protected access.

The vendor configuration utility for the Ebyte NA111-M grants access to administrative functions without verifying the operator's identity under certain credential conditions, an issue classified as weak authentication (CWE-1390). An unauthenticated attacker positioned on the adjacent network can reach the utility and invoke these administrative functions without valid credentials. By doing so, the attacker can modify critical device settings or change access credentials, which could lock legitimate administrators out of the device. Deployments of the affected Ebyte product in which the configuration interface is reachable from an adjacent network are at risk. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known; EPSS currently estimates only a 0.5% probability of exploitation in the next 30 days, although the CVSS 4.0 score of 9.3 (critical) reflects high potential impact.

Do: Restrict access to the NA111-M's configuration utility to trusted management segments (e.g., VLANs, ACLs, or firewall rules) so that adjacent-network attackers cannot reach the interface, and monitor devices for unexpected configuration or credential changes. Check the CISA ICS-CERT advisory and Ebyte's release notes for patched firmware or configuration-utility versions, and apply the vendor's fix as soon as it is identified. If remote administration is not required, disable or firewall the configuration interface until an update is applied.

The web management interface of the Ebyte NA111-M does not restrict itself from being rendered inside an external frame, a frame-injection flaw classified as CWE-1021 (improper restriction of rendered UI layers or frames), enabling classic clickjacking/UI-redress attacks. An unauthenticated remote attacker can host a crafted webpage that, when visited by an already-authenticated administrator, invisibly overlays or embeds the device's management interface so that the admin's clicks trigger unintended configuration changes or disruptive actions on the device. Per the CVSS 4.0 vector (UI:P, VC:L/VI:L/VA:N), the attack requires user interaction and yields limited confidentiality and integrity impact rather than availability loss. Only deployments of the affected Ebyte device web management interface are impacted, and exploitation depends on the administrator's browser being able to reach both the attacker's page and the device UI. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days.

Do: No fixed version is specified in the available data, so monitor Ebyte (and the ICS CERT advisory) for a firmware update that adds frame-ancestors/X-Frame-Options protection to the web interface. As interim mitigations, log out of the device management UI before browsing untrusted websites, restrict access to the management interface to trusted management networks, and avoid multitasking between the device UI and other web pages in the same browser session.

CVE-2026-75814 is a cross-site request forgery (CWE-352) weakness in the web management interface of the Ebyte NA111-M device, which does not adequately verify the origin or authenticity of the requests it accepts. An unauthenticated remote attacker triggers the flaw by persuading an administrator who is already logged into the interface to visit a crafted web page, causing the victim's browser to silently submit forged requests. Successful exploitation allows unauthorized configuration changes or a denial-of-service condition that disrupts device availability, consistent with the 8.6 (High) CVSS 4.0 score, which requires network access, no privileges, and active user interaction. Any organization operating an affected NA111-M device whose management interface is reachable by both administrators and untrusted web content is exposed, although no specific affected version ranges are provided in the available data. There is currently no known exploitation: no public proof-of-concept exists, the flaw is not in CISA's KEV catalog, and EPSS assigns only a 0.2% probability of exploitation within 30 days (7th percentile).

Do: No fixed firmware version is given in the available data, so check the CISA ICS advisory for CVE-2026-75814 and EBYTE support channels for an updated release and apply it when published. Until then, restrict the NA111-M web management interface to trusted management networks or VPN access, log out of admin sessions when not in use, and avoid browsing untrusted sites while authenticated; review device configuration and logs for unexplained changes.

CVE-2026-76133 describes a use of a deprecated hashing algorithm (CWE-327) in an authentication-related operation on an Ebyte product, identified in related coverage as the NA111-M. The flaw is triggered when an attacker is in a position to manipulate or predict the authentication exchange, at which point the weak hash construction undermines the assurance the mechanism is meant to provide. An attacker who exploits this may achieve unauthorized access to the device or its services; the CVSS 4.0 score of 9.3 (critical) reflects network-based, unauthenticated exploitation with potentially high confidentiality, integrity, and availability impact. Users and operators of Ebyte NA111-M devices, which are typically deployed in IoT and industrial connectivity roles, are affected. Exploitation has not been observed: there is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS estimates only a 0.4% chance of exploitation in the next 30 days.

Do: Check whether NA111-M modules in your environment expose their authentication interfaces to untrusted or internet-facing networks, and restrict access with firewalling or network segmentation in the meantime. Watch for the CISA ICS-CERT advisory and vendor guidance for patched firmware, and upgrade as soon as a fixed version is published; avoid relying on the affected authentication exchange for security-critical access controls until then.

CVE-2026-76179 is an improper protection of authentication tokens flaw (CWE-598) in the web management interface of certain Ebyte gateway products, where session tokens are insufficiently protected during client-side session handling. An attacker who can obtain exposed session information (for example from logs, URLs, or other artifacts where the token is visible) can reuse a valid token to hijack the session. Successful exploitation lets the attacker impersonate an authenticated user and gain unauthorized access to device management functionality, with high impact to confidentiality, integrity, and availability per the 9.3 critical CVSS 4.0 score. Operators of the affected Ebyte gateways — including the NA111-M model cited in related coverage — are in scope, though no specific vulnerable version ranges are published. There is currently no known public proof-of-concept, it is not in the CISA KEV catalog, and EPSS puts 30-day exploitation probability at roughly 0.4%.

Do: No fixed version is published in the available data, so check with Ebyte/EBYTE support for a firmware update for your gateway model (e.g., NA111-M) and apply it when available. In the meantime, do not expose the device's web management interface to the internet or untrusted networks, use HTTPS where supported, and avoid sharing or bookmarking URLs that contain session tokens. Review access logs and active sessions for signs of token reuse, and revoke/re-establish sessions after updating.

CVE-2026-76940 is a CWE-307 weakness (improper restriction of excessive authentication attempts) in the Ebyte NA111-M device, which enforces neither rate limiting nor account lockout on repeated authentication attempts. A remote, unauthenticated attacker can therefore automate repeated login guesses over the network (CVSS 4.0: network vector, low complexity, no privileges or user interaction required). If a guess succeeds, the attacker gains valid authenticated access to the device, with high confidentiality impact per the CVSS scoring (VI:N/VA:N, VC:H). Exposure is limited to deployments that rely on password-based authentication and whose authentication interface is reachable by an attacker, such as internet-exposed or flat-network installations. No public proof-of-concept, KEV listing, or confirmed exploitation is known; EPSS currently estimates only a ~0.4% probability of exploitation within 30 days.

Do: Until vendor guidance or a firmware fix is published, restrict reachability of the device's authentication interface (firewall ACLs, VPN-only access), avoid exposing password-based login directly to the internet, and ensure a strong unique password is in use. Check whether your deployments authenticate via passwords and review device logs for signs of automated guessing; monitor the vendor and CISA ICS advisories for updated firmware or mitigations.

The Ebyte NA111-M does not enforce separation between limited-user and administrative management functions, a missing-authorization issue (CWE-862). An attacker holding valid low-privileged credentials can reach security-sensitive configuration functions over the network, with no user interaction required. By modifying those settings, the attacker can affect the confidentiality, integrity, or availability of the device itself; the CVSS 4.0 scoring indicates no impact on downstream systems. Only deployments of the NA111-M that expose the management interface and have low-privileged accounts are affected. Exploitation has not been observed: there is no public proof-of-concept, the issue is not in CISA's KEV, and EPSS estimates only a 0.4% probability of exploitation within 30 days.

Do: Because no fixed version is specified in the available data, check the CISA ICS-CERT advisory and Ebyte's channels for updated NA111-M firmware and apply it when released. In the interim, restrict access to the device's management interface via network segmentation and allowlisting, and audit or revoke low-privileged accounts that should not be able to change device configuration.

The affected Ebyte device, identified in related reporting as the NA111-M, exports administrative credentials and other sensitive configuration information without adequate protection (cleartext storage of sensitive information, CWE-312). An unauthenticated attacker positioned on the adjacent network who can obtain an exported configuration file can recover the stored credentials and use them to authenticate to the device. Because credentials may be reused, the attacker could also gain access to similarly configured systems in the deployment. Any site operating the affected Ebyte product, particularly industrial or IoT deployments where configuration files are exchanged or archived, is potentially affected. No public proof-of-concept, CISA KEV listing, or known exploitation exists; EPSS estimates only a 0.2% chance of exploitation in the next 30 days.

Do: Restrict access to exported configuration files, rotate administrative credentials on any device whose configuration export has been shared or stored, and segment networks to limit adjacent-network access to device management interfaces. Monitor CISA ICS-CERT and vendor advisories for confirmed affected firmware ranges and apply the fixed firmware as soon as it is published.

The Ebyte NA111-M gateway's vendor configuration utility performs disruptive administrative actions without requiring authentication whenever the device is still using its default credentials. An unauthenticated attacker with access to the adjacent network (e.g., the same LAN or industrial network segment) can trigger a device reboot or a factory reset, wiping the configuration and causing loss of service availability. There is no confidentiality impact, but integrity and availability impacts are rated high under CVSS 4.0 (7.2, High), and the issue is tracked as CWE-306 (Missing Authentication for Critical Function). Organizations operating NA111-M gateways that have not changed the factory default credentials are affected. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days.

Do: Change the default credentials on affected NA111-M gateways so the configuration utility requires authentication, and restrict access to the management interface to trusted network segments. Check gateways for unexplained reboots or unexpected factory-default configurations, and monitor Ebyte's advisories for firmware or utility updates addressing this issue.