CISA Warns of Critical Flaws in Ebyte NA111-M Gateway Allowing Full Device Compromise

CISA released an advisory (ICSA-26-239-05) on August 27, 2026, disclosing 13 vulnerabilities affecting the Ebyte NA111-M gateway running firmware version 9013-2-17. The vulnerabilities, which include missing authentication for critical functions, CSRF, and cleartext transmission of sensitive information, could allow an attacker to fully compromise the device. The advisory notes that the device is deployed worldwide in the Information Technology critical infrastructure sector.

The most severe issues (CVE-2026-73125, CVE-2026-76179, and others) carry a CVSS v3.1 base score of 9.8, indicating critical severity. An unauthenticated remote attacker could exploit these flaws to access sensitive configuration data, modify device settings, or cause denial of service. Other vulnerabilities, such as CVE-2026-75814 (CSRF), require user interaction but still allow unauthorized configuration changes.

Ebyte acknowledged the reported vulnerabilities and indicated that a patch was under development, but the vendor has not responded to subsequent coordination requests, and CISA has not been informed of the patch's status. As a result, no official remediation is currently available.

Organizations using the Ebyte NA111-M should treat the device as at risk and implement immediate mitigation measures, including restricting network access to the management interface and monitoring for suspicious activity.