CVE-2026-75814CWE-352csrf

CVE-2026-75814

High · published August 28, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

The Ebyte device does not adequately verify the origin or authenticity of

requests submitted to the web management interface. An unauthenticated

remote attacker could persuade an authenticated administrator to visit a

crafted page, causing unauthorized configuration changes or a

disruption of device availability.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-08-28T04:18Z
References (2)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06 · [email protected]
EPSS history
Timeline
  • 27 AUG 21:25Z
    Ebyte NE2-D11 Cross-Site Request Forgery
    cvelistv5