CVE-2026-71187: critical vulnerability in Ebyte NA111-M Firmware
Ebyte NA111-M Use of Client-Side Authentication
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 0.8%
The Ebyte device relies on client side authentication logic that can be
reproduced by unauthenticated users. An attacker may generate valid
authentication requests and bypass authentication to obtain
administrative access to the device.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Ebyte · Ebyte NA111-M FirmwareRelated CVEs — Ebyte NA111-M Firmware
In the same product, most dangerous first.
CVE-2026-73125CRITICALEbyte NA111-M Missing Authentication for Critical FunctionEPSS 0.8%CVE-2026-76179CRITICALEbyte NA111-M Use of GET Request Method With Sensitive Query StringsEPSS 0.7%CVE-2026-73819CRITICALEbyte NA111-M Weak AuthenticationEPSS 0.5%CVE-2026-76940HIGHEbyte NA111-M Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2026-77966HIGHEbyte NA111-M Missing AuthorizationEPSS 0.4%CVE-2026-76133CRITICALEbyte NA111-M Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.4%