Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Ebyte device web interface allows unauthenticated changes

CVE-2026-73125 · published 7 days ago
Summary

The web management page of Ebyte devices does not always require a login before showing or allowing changes to important settings. This means someone on the network could view configuration details, alter how the device works, or cause it to stop functioning. Apply the vendor’s security update or restrict access to the management page until it is fixed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ebyte ebyte na111-m firmware 9013-2-17
Original advisory text
Ebyte NA111-M Missing Authentication for Critical Function
Ebyte device web management interface does not consistently enforce
authentication before granting access to administrative functionality.
An unauthenticated remote attacker could access sensitive configuration
information, modify device settings, or disrupt availability.
References
Severity
9.3 Critical
CVSS 3.1: 9.8 (NVD)
CVSS 4.0: 9.3 (NVD)
Exploitation
EPSS <1%
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published27 Aug 2026
Updated3 Sep 2026
First seen28 Aug 2026
Sources
CVE-2026-73125 · NVD
CVE-2026-73125 · MITRE
Monitor software like this
Free during beta