CISA issued an ICS advisory (ICSA-26-239-05) for Ebyte NA111-M Firmware 9013-2-17, disclosing 13 vulnerabilities with a maximum CVSS v3 score of 9.8 (Critical). Successful exploitation could allow an attacker to fully compromise the device. Vulnerabilities include Missing Authentication for Critical Functions, CSRF, Use of Client-Side Authentication, Cleartext Transmission of Sensitive Information (HTTP and MQTT), Weak Authentication, Missing Authorization, Broken Cryptographic Algorithms, and Cleartext Storage of Sensitive Information. The device is deployed worldwide in the Information Technology critical infrastructure sector by China-based vendor Ebyte. Ebyte acknowledged the vulnerabilities and indicated a patch was under development but has not responded to subsequent coordination requests. No patch is currently available; CISA recommends network isolation, firewall segmentation, and VPN use as mitigations. The vulnerabilities were reported by Jithin Nambiar J.
