CVE-2026-76940CWE-307

CVE-2026-76940

High · published August 28, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

The affected Ebyte device does not restrict repeated authentication

attempts through rate limiting or account lockout mechanisms. This could

allow an attacker to perform automated authentication attacks against

deployments that rely on password based authentication.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00504 · 42.2th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-08-28T04:18Z
References (2)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06 · [email protected]
EPSS history
Timeline
  • 27 AUG 21:28Z
    Ebyte NE2-D11 Improper Restriction of Excessive Authentication Attempts
    cvelistv5