CVE-2026-77977CWE-306

CVE-2026-77977

High · published August 28, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
29.3
In the wild
Unconfirmed
What it is

Ebyte gateway product's vendor configuration utility does not require authentication before

allowing certain disruptive administrative actions when default

credentials remain configured. An unauthenticated attacker on the

adjacent network could reboot the device or restore factory settings,

resulting in a loss of configuration and service availability.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
7.2 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00367 · 29.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-28T04:18Z
References (2)
EPSS history
Timeline
  • 27 AUG 21:56Z
    Ebyte NE2-D11 Missing Authentication for Critical Function
    cvelistv5