CVE-2026-73125CWE-306

CVE-2026-73125

Critical · published August 28, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
56.0
In the wild
Unconfirmed
What it is

Ebyte device web management interface does not consistently enforce

authentication before granting access to administrative functionality.

An unauthenticated remote attacker could access sensitive configuration

information, modify device settings, or disrupt availability.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00795 · 56.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-28T04:18Z
References (2)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06 · [email protected]
EPSS history
Timeline
  • 27 AUG 21:13Z
    Ebyte NE2-D11 Missing Authentication for Critical Function
    cvelistv5