by Kastro
Paper/Archive/CVE-2026-71187

CVE-2026-71187

Ebyte Ebyte NA111-M Firmware — Ebyte NA111-M Use of Client-Side Authentication

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.9.559 × 2011.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device.

Affected

ProductAffectedFixed inSource
Ebyte NA111-M Firmware9013-2-17–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-26-237-06refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json