CVE-2026-76940: CWE-307 in Ebyte Ebyte NA111-M Firmware

CVE-2026-76940 identifies a security weakness in Ebyte NA111-M Firmware version 9013-2-17 where the firmware does not implement rate limiting or account lockout controls on authentication attempts. This absence of protections allows attackers to conduct automated password guessing attacks against the device's password-based authentication mechanism. The vulnerability is classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts). The CVSS 3.1 base score is 7.5 (high), reflecting the network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. No official patch or vendor remediation information is provided, and no active exploitation has been reported.

Successful exploitation could allow an attacker to gain unauthorized access to the affected device by repeatedly guessing passwords without being blocked or rate limited. This compromises the confidentiality of the device but does not impact integrity or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing compensating controls such as network-level access restrictions or monitoring for suspicious authentication attempts if possible.