| Ebyte NA111-M Industrial Gateway
|
|
Security Grade
Calculator v1
|
Ebyte NA111-M Industrial Gateway
Release Date: 2026-08-27 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Industrial gateway; vulnerabilities are primarily software/web-interface based, not physical tampering .
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
13 CVEs affect firmware 9013-2-17, including CVE-2026-73125 (CVSS 9.8, missing authentication) and CVE-2026-76179 (CVSS 9.8, token handling) .
|
| Prior attacks
|
None
|
🔗 Proof
|
EPSS score 0.0053 indicates no widespread active exploitation observed as of Aug 2026 .
|
| Updatability
|
Rare
|
🔗 Proof
|
Ebyte acknowledged the vulnerabilities and stated a patch was under development, but has not responded to subsequent CISA coordination requests; patch status unknown .
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
No
|
🔗 Proof
|
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
|
| Storage
|
No encryption
|
🔗 Proof
|
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Absent
|
🔗 Proof
|
|
| Authentication
|
Absent
|
🔗 Proof
|
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
|
| Event logging
|
Partial logging
|
🔗 Proof
|
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded firmware (Companion App: Web management interface)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: DC (industrial) • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Ethernet, serial (RS232/RS485), Wi-Fi (model-dependent)
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
The Ebyte NA111-M is an industrial IoT gateway running firmware 9013-2-17, affected by 13 CVEs disclosed in CISA advisory ICSA-26-239-05 (August 2026) . The most critical flaws include CVE-2026-73125 (CVSS 9.8, missing authentication on web management interface, allowing unauthenticated remote attackers to access sensitive configuration and modify device settings) and CVE-2026-76179 (CVSS 9.8, improper authentication token protection enabling session hijacking) . Additional issues span CSRF, cleartext transmission/storage of credentials, weak cryptographic algorithms, and lack of privilege separation . The vendor acknowledged the vulnerabilities and stated a patch was under development but has not provided a patch or responded to CISA coordination requests as of the advisory publication . EPSS scores for the critical CVEs (0.0053, 0.00434) indicate no widespread active exploitation has been observed, but the authentication bypass nature of the flaws makes them severe for internet-exposed industrial deployments . Users are advised to contact Ebyte directly and isolate affected devices from public networks.
