Ebyte NA111-M
CISA reports 13 vulnerabilities, including CVSS 9.8 missing-authentication flaws, in Ebyte NA111-M firmware that allow full device compromise.
CISA published ICS advisory ICSA-26-239-05 for Ebyte NA111-M firmware 9013-2-17, listing 13 vulnerabilities tracked from CVE-2026-73125 through CVE-2026-77977. The issues include missing authentication for critical functions, GET requests with sensitive query strings, cross-site request forgery, improper restriction of excessive authentication attempts, and missing authorization. The vendor-assessed CVSS v3 score is 9.8, and successful exploitation could allow an attacker to fully compromise the device. No remediation details are included in the summary text.
- Thirteen CVEs affect NA111-M firmware 9013-2-17
- CVSS v3 score is 9.8; exploitation could fully compromise the device
- Issues include missing authentication, CSRF, and missing authorization
- No patch or mitigation details are given in the advisory summary
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-71187 | Client-side authentication bypass in Ebyte NA111-M device | 9.3 group max | <1% | ||
| CVE-2026-73125 | Missing Authentication in Ebyte NA111-M Web Management Interface | 9.3 | <1% | ||
CVE-2026-73819+3 related CVEs | Authentication Bypass in Ebyte NA111-M Configuration Utility | 9.3 group max | <1% | ||
| CVE-2026-75814 | Cross-Site Request Forgery in Ebyte NA111-M Web Management Interface | 8.6 | <1% | ||
| CVE-2026-76179 | Improperly Protected Auth Tokens in Ebyte Gateway Web Interface (incl. NA111-M) | 9.3 | <1% |
From the original article
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to fully compromise the device.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.