# Ebyte NA111-M gateway multiple authentication flaws

Published: 2026-08-27 · Severity: routine · Sectors: technology, infrastructure
Canonical: https://vorant.io/reports/6fa675e2-b078-50a6-885c-6acb463980c3/ebyte-na111-m-gateway-multiple-authentication-flaws

> Thirteen vulnerabilities in Ebyte NA111-M firmware allow unauthenticated remote attackers to fully compromise the device; no patch available.

CISA published an advisory covering thirteen distinct vulnerabilities affecting Ebyte NA111-M gateway firmware version 9013-2-17, a device deployed worldwide in Information Technology critical infrastructure. The flaws span authentication bypass, privilege escalation, and information disclosure, collectively enabling an unauthenticated remote attacker to gain full administrative control of the device. Key weaknesses include missing authentication enforcement on administrative functions (CVE-2026-73125, CVE-2026-73819, CVE-2026-77977), client-side authentication logic that can be reproduced by attackers (CVE-2026-71187), cleartext transmission of authentication tokens and MQTT credentials (CVE-2026-73809, CVE-2026-69658), insufficient token protection (CVE-2026-76179), cross-site request forgery (CVE-2026-75814), clickjacking via unprotected framing (CVE-2026-75548), lack of rate limiting on authentication attempts (CVE-2026-76940), privilege escalation from low-privilege users (CVE-2026-77966), weak cryptographic hashing (CVE-2026-76133), and exposure of credentials in unprotected configuration exports (CVE-2026-77975). Ebyte acknowledged receipt and indicated patches were under development, but has not responded to CISA coordination requests and no patch status has been communicated. No public exploitation has been reported to date. Defenders should isolate affected devices from internet exposure, place them behind firewalls, and restrict network access until patches become available.

## Mentioned in this report

- Vulnerabilities: CVE-2026-69658, CVE-2026-71187, CVE-2026-73125, CVE-2026-73809, CVE-2026-73819, CVE-2026-75548, CVE-2026-75814, CVE-2026-76133, CVE-2026-76179, CVE-2026-76940, CVE-2026-77966, CVE-2026-77975, CVE-2026-77977

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-05

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6fa675e2-b078-50a6-885c-6acb463980c3/ebyte-na111-m-gateway-multiple-authentication-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup