CISA Warns of 13 Critical Flaws in Ebyte NA111-M Gateways, No Patch in Sight

Key points

• CISA disclosed 13 vulnerabilities in the Ebyte NA111-M gateway, firmware version 9013-2-17, with the worst rated 9.8 out of 10 on the industry severity scale.
• The flaws allow a remote attacker to fully take over the device without a password.
• Ebyte, headquartered in China, acknowledged the report but has since gone silent, and no patch has been released.
• The devices are deployed worldwide in the information technology sector.
• Owners have no fix available and are being told to contact the vendor directly.

A small industrial gateway sold worldwide by Chinese manufacturer Ebyte can be hijacked over the internet by anyone who knows where to look. No patch exists. Ebyte isn't talking.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an advisory this week detailing 13 separate security flaws in the Ebyte NA111-M, a network gateway used to connect industrial equipment to corporate networks. Every version running firmware 9013-2-17 is affected.

The core problem is authentication, or the absence of it. The device's web management interface, the browser-based control panel an administrator uses to configure it, doesn't always check whether the person clicking is actually logged in. That flaw, tracked as CVE-2026-73125, scores 9.8 out of 10 for severity. An attacker anywhere on the internet can read settings, alter them, or knock the device offline entirely.

Twelve more issues accompany it. Some are as basic as sending passwords across the network in plain text, so anyone watching the traffic can grab them. Others let an attacker trick a logged-in administrator into making changes without realising it, a technique called cross-site request forgery. The device also has no lockout after repeated failed logins, meaning password-guessing runs unconstrained.

Who makes this device and where is it used?

Ebyte is a Chinese electronics manufacturer whose NA111-M is sold as an industrial serial-to-Ethernet gateway. CISA lists deployments as worldwide and places the device in the information technology sector. Gateways like this sit inside factories, utilities and building management systems, translating data between legacy serial equipment and modern networks. They're easy to overlook on an asset inventory, which is part of what makes them attractive to attackers.

We've tracked the vendor-goes-quiet pattern across 16 ICS security stories in the last 90 days, and this case is one of the cleaner illustrations of what it costs operators when a small vendor stops picking up the phone.

Is there a patch?

No. CISA says Ebyte confirmed receipt of the vulnerability report and indicated a patch was under development. Then the company stopped responding. CISA hasn't been told when, or whether, a fix will ship. Owners are being directed to contact Ebyte directly, which is an unusually candid admission that the official coordination channel has broken down.

What should owners do now?

Assume the device shouldn't be reachable from the public internet. Any NA111-M with its web interface exposed online should be placed behind a firewall or VPN immediately. Network administrators should check logs for unexpected configuration changes and rotate any credentials that may have crossed the device in plain text.

Beyond that, there's little to do until Ebyte ships firmware.

Why this matters beyond the device itself

Gateways are quiet targets. They rarely appear on an asset inventory, they sit at the network edge, and they often hold credentials that reach more valuable systems inside. A gateway an attacker fully controls is a foothold, not just a broken box.

The real story here isn't the vulnerability count. It's that the remediation column says "contact the vendor" while the vendor has gone dark. Buyers of small industrial devices need networks designed to survive exactly that outcome, because it's happening with regularity.