CVE-2026-75548: CWE-1021 Improper Restriction of Rendered UI Layers or Frames in Ebyte Ebyte NA111-M Firmware

This vulnerability (CWE-1021) affects the Ebyte NA111-M firmware version 9013-2-17. The web management interface lacks proper restrictions on being rendered within external frames, enabling a potential clickjacking attack. An unauthenticated remote attacker could exploit this to deceive an authenticated administrator into executing unintended configuration changes or disruptive actions. The CVSS 3.1 base score is 5.4, reflecting a medium severity with low complexity and no privileges required but requiring user interaction.

The impact is limited to low confidentiality and integrity loss, with no availability impact. An attacker could trick an authenticated administrator into making unintended configuration changes or disruptive actions, potentially affecting device configuration integrity.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about accessing the management interface from untrusted networks or browsers and consider implementing frame-busting techniques or Content Security Policy frame-ancestors directives if possible.