by Kastro
Paper/Archive/CVE-2026-73125

CVE-2026-73125

Ebyte Ebyte NA111-M Firmware — Ebyte NA111-M Missing Authentication for Critical Function

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 56.3.563 × 2011.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability.

Affected

ProductAffectedFixed inSource
Ebyte NA111-M Firmware9013-2-17–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-26-237-06refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json