NA111-M (Firmware 9013-2-17) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/na111-m-firmware-9013-2-17/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 27 Aug 2026 16:05:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCritical Vulnerabilities in Ebyte NA111-M Firmwarehttps://feed.craftedsignal.io/briefs/2026-08-ebyte-na111-m-vulnerabilities/Thu, 27 Aug 2026 16:05:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-ebyte-na111-m-vulnerabilities/Multiple critical vulnerabilities in Ebyte NA111-M firmware version 9013-2-17, including missing authentication and authorization bypasses, allow unauthenticated remote attackers to gain full administrative control.Ebyte NA111-M devices running firmware version 9013-2-17 are affected by a collection of thirteen critical security vulnerabilities. These flaws, which include missing authentication for critical functions, improper token management, and lack of authentication rate limiting, expose the device to full compromise by unauthenticated remote attackers. An adversary can exploit these weaknesses to access sensitive configuration data, modify system settings, or cause a denial-of-service condition. Because the web management interface does not consistently verify origin or privilege levels, an attacker can effectively bypass security controls to gain administrative access. The vendor has acknowledged these findings but has not released security patches to address these issues. Organizations deploying these devices globally in the Information Technology sector should take immediate steps to isolate affected hardware from the public internet.

Attack Chain

  1. An attacker identifies an internet-facing Ebyte NA111-M device via network scanning.
  2. The attacker targets the web management interface using CVE-2026-73125 to gain unauthenticated access to device settings.
  3. Alternatively, the attacker uses CSRF (CVE-2026-75814) by tricking an administrator into interacting with a malicious link to trigger unauthorized configuration changes.
  4. The attacker performs brute-force or credential-stuffing attacks against the management portal, aided by the lack of rate limiting (CVE-2026-76940).
  5. The attacker intercepts or steals session tokens due to improper client-side protection (CVE-2026-76179) to impersonate legitimate administrative sessions.
  6. The attacker leverages the lack of function separation (CVE-2026-77966) to escalate from a low-privileged user to full administrative rights.
  7. Final objectives include device exfiltration of sensitive configuration data or complete disruption of service.

Impact

Successful exploitation results in full administrative control over the Ebyte NA111-M device. This allows for the compromise of internal network information, modification of device behavior, and persistent denial-of-service, impacting organizations that rely on these gateways for IT operations.

Recommendation

  • Isolate the Ebyte NA111-M web management interface from the public internet to mitigate unauthorized access.
  • Monitor webserver logs for high-frequency requests from single source IPs to the device management interface, signaling potential brute-force attempts (CVE-2026-76940).
  • Block unauthorized access to the device management interface at the perimeter firewall, permitting only known administrative IP ranges.
  • Contact Ebyte support for status updates regarding pending security patches for the 9013-2-17 firmware.
]]>criticaladvisory