Jithin Nambiar

**Name of the Vulnerable Software and Affected Versions** Ebyte NE2-D11 (affected versions not specified) **Description** MQTT credentials and control traffic are transmitted in cleartext, which exposes sensitive information to network-level attackers. This flaw may allow unauthorized device impersonation and the disruption of messaging functions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ebyte device (affected versions not specified) **Description** The device relies on client-side authentication logic that can be reproduced by unauthenticated users. This allows an attacker to generate valid authentication requests and bypass security checks to obtain administrative access to the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ebyte NE2-D11 version FW-9167-0-11 Ebyte NA111-M (affected versions not specified) **Description** The web management interface fails to consistently enforce authentication before granting access to administrative functionality. This allows an unauthenticated remote attacker to access sensitive configuration information, modify device settings, or disrupt the availability of the device. **Recommendations** For Ebyte NE2-D11 version FW-9167-0-11, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Ebyte NA111-M, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ebyte gateway products (affected versions not specified) **Description** Certain gateway products transmit sensitive information in cleartext because the web management interface lacks adequate transport-layer encryption. This allows an attacker with network traffic access to intercept session-related or authentication data, potentially leading to unauthorized access to device management functions and disclosure of sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict network access to the device to minimize the risk of interception.

Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the risk of credential compromise through visual or remote observation. This undermines the confidentiality of device access.

**Name of the Vulnerable Software and Affected Versions** Ebyte NE2-D11 (affected versions not specified) **Description** The web management interface of the device fails to restrict the interface from being rendered within an external frame. This allows an unauthenticated remote attacker to use a crafted webpage to trick an authenticated administrator into performing unintended configuration changes or disruptive actions through a clickjacking attack, where a user is deceived into clicking something different from what they perceive. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ebyte NE2-D11 (affected versions not specified) **Description** Certain configuration endpoints lack proper server-side authorization checks. This flaw allows unauthorized users to access or modify sensitive device settings, which could lead to a full compromise of device functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ebyte NE2-D11 (affected versions not specified) **Description** The web management interface fails to properly verify the origin or authenticity of submitted requests. This allows an unauthenticated remote attacker to trick an authenticated administrator into visiting a specially crafted page, which can lead to unauthorized configuration changes or a disruption of device availability. This issue is a Cross-Site Request Forgery (CSRF), a type of attack that forces an authenticated user to execute unwanted actions on a web application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ebyte gateway products (affected versions not specified) **Description** Improper protection of authentication tokens in the web management interface occurs during client-side session handling. This flaw allows an attacker who obtains exposed session information to reuse a valid token, enabling them to impersonate an authenticated user and gain unauthorized access to device management functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ebyte NE2-D11 (affected versions not specified) **Description** The device fails to restrict repeated authentication attempts because it lacks rate limiting or account lockout mechanisms. This deficiency allows attackers to conduct automated authentication attacks against deployments utilizing password-based authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.