Echo Mate CVE-2026-4736

Requires local access with low-privilege user account on No-Chicken Echo-Mate devices running SDK/rv1106-sdk before version V250329. Attacker must manipulate netfilter nf_tables module values through nft_byteorder or nft_meta components. No victim interaction needed.

Without an assigned CVSS score or vector, risk assessment relies on alternative signals. The vulnerability is tagged as 'Information Disclosure,' suggesting confidentiality impact rather than integrity or availability compromise. CWE-229 is a broad weakness category indicating improper value handling, which typically requires specific conditions to exploit. The availability of a vendor patch indicates acknowledged severity and demonstrable exploitability. The absence of CVSS metrics and EPSS score prevents quantified risk comparison, but the classification as information disclosure and the requirement for kernel-level netfilter operations suggests medium real-world risk—not immediately critical but requiring timely patching for production systems. The fact that GovTech CSG reported this indicates government security interest, elevating priority for publicly-exposed or critical infrastructure deployments. Without confirmed KEV status or public POC, opportunistic mass exploitation is unlikely, but targeted attacks against Echo-Mate deployments are plausible.

An attacker with network-level access or the ability to send crafted netfilter-processed packets could exploit improper value handling in the byte-order or metadata operations to extract sensitive packet information or internal state from the Echo-Mate kernel modules. For example, a malicious packet sequence could trigger unvalidated value processing in nft_meta.C, causing the kernel to leak memory contents or bypass filter rules, allowing the attacker to observe traffic that should be filtered or blocked. The attack likely requires local or adjacent network access and may not trigger via remote unauthenticated requests, limiting immediate internet-facing risk.