CVE-2026-73125

CVSS 9.8 (critical) · published 2026-08-28

Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability.

Weakness: CWE-306

Source: NVD CVE-2026-73125

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.