Ebyte Na111 M Firmware
Monthly
Missing authorization controls in the Ebyte NA111-M industrial wireless module firmware allow a low-privileged authenticated user to access and modify administrative configuration functions that should be restricted to privileged accounts. The device fails to enforce privilege separation between limited-user and administrator roles, meaning any authenticated operator-level account can alter security-sensitive settings and affect device confidentiality, integrity, and availability. The attack is network-accessible with no user interaction required (CVSS 4.0: 8.7), posing a practical risk in OT/ICS environments; no public exploit has been identified at time of analysis.
Missing authorization controls in the Ebyte NA111-M industrial wireless module firmware allow a low-privileged authenticated user to access and modify administrative configuration functions that should be restricted to privileged accounts. The device fails to enforce privilege separation between limited-user and administrator roles, meaning any authenticated operator-level account can alter security-sensitive settings and affect device confidentiality, integrity, and availability. The attack is network-accessible with no user interaction required (CVSS 4.0: 8.7), posing a practical risk in OT/ICS environments; no public exploit has been identified at time of analysis.