Read the docs
TI-2026-53291 Aliases CVE-2026-76179GHSA-62mm-rmvp-f5p7

Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings

Priority MEDIUM 49CWE-598Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session information to obtain and reuse a valid token. Successful exploitation could allow an attacker to impersonate an authenticated user and gain unauthorized access to device management functionality.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00652 51st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EbyteEbyte NA111-M Firmware9013-2-17—No fix listedCNA
  • Ebyte NA111-M Firmware VendorEbyte Affected 9013-2-17 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76179
  2. 2026-10-03 Alias added: GHSA-62mm-rmvp-f5p7
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Other 2

  • TI-2026-51301 Ebyte NA111-M Missing Authentication for Critical Function CVSS 4.0CRITICAL 9.3
  • TI-2026-49868 Ebyte NA111-M Use of Client-Side Authentication CVSS 4.0CRITICAL 9.3
  • TI-2026-53263 Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm CVSS 4.0CRITICAL 9.3
  • TI-2026-48951 Ebyte NA111-M Cleartext Transmission of Sensitive Information CVSS 4.0CRITICAL 9.3
  • TI-2026-53750 Ebyte NE2-D11 Use of Client-Side Authentication CVSS 4.0HIGH 8.7
  • TI-2026-53748 Ebyte NA111-M Improper Restriction of Excessive Authentication Attempts CVSS 4.0HIGH 8.7
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences