Ebyte NA111-M gateway multiple authentication flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Thirteen vulnerabilities in Ebyte NA111-M firmware allow unauthenticated remote attackers to fully compromise the device; no patch available.
CISA published an advisory covering thirteen distinct vulnerabilities affecting Ebyte NA111-M gateway firmware version 9013-2-17, a device deployed worldwide in Information Technology critical infrastructure. The flaws span authentication bypass, privilege escalation, and information disclosure, collectively enabling an unauthenticated remote attacker to gain full administrative control of the device. Key weaknesses include missing authentication enforcement on administrative functions (CVE-2026-73125, CVE-2026-73819, CVE-2026-77977), client-side authentication logic that can be reproduced by attackers (CVE-2026-71187), cleartext transmission of authentication tokens and MQTT credentials (CVE-2026-73809, CVE-2026-69658), insufficient token protection (CVE-2026-76179), cross-site request forgery (CVE-2026-75814), clickjacking via unprotected framing (CVE-2026-75548), lack of rate limiting on authentication attempts (CVE-2026-76940), privilege escalation from low-privilege users (CVE-2026-77966), weak cryptographic hashing (CVE-2026-76133), and exposure of credentials in unprotected configuration exports (CVE-2026-77975). Ebyte acknowledged receipt and indicated patches were under development, but has not responded to CISA coordination requests and no patch status has been communicated. No public exploitation has been reported to date. Defenders should isolate affected devices from internet exposure, place them behind firewalls, and restrict network access until patches become available.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-05
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs