CVE-2026-73125: CWE-306 in Ebyte Ebyte NA111-M Firmware

CVE-2026-73125 is a critical security vulnerability in the Ebyte NA111-M firmware version 9013-2-17. The flaw stems from the web management interface failing to consistently enforce authentication, enabling unauthenticated remote attackers to gain administrative access. This can result in unauthorized disclosure of sensitive configuration information, unauthorized changes to device settings, and potential denial of service by disrupting device availability. The vulnerability has a CVSS 3.1 base score of 9.8, indicating a high severity with network attack vector, no privileges required, and no user interaction needed.

Exploitation of this vulnerability allows remote attackers without any authentication to access administrative functions on the affected device. This can lead to full compromise of device configuration, exposure of sensitive data, unauthorized configuration changes, and disruption of device operations, impacting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted networks only and monitor for unauthorized access attempts.