CVE-2026-75548

Deferred Deferred - Pending Action

Clickjacking Vulnerability in Ebyte Device Web Interface

Publication date: 2026-08-28

Last updated on: 2026-08-31

Assigner: ICS-CERT

Description

The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into initiating unintended configuration changes or disruptive actions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-31

Generated

2026-10-19

AI Q&A

2026-08-28

EPSS Evaluated

2026-10-18

NVD

CVE-2026-75548

EUVD

EUVD-2026-67287

Affected Vendors & Products

Vendor	Product	Version / Range
ebyte	csafpid-0001	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1021	The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

Attack-Flow Graph

Executive Summary

The vulnerability involves an Ebyte device's web management interface that can be embedded in an external frame without restrictions. This allows an unauthenticated remote attacker to trick an authenticated administrator into performing unintended actions through a crafted webpage.

Detection Guidance

This vulnerability involves a web management interface being rendered in an external frame, which could allow clickjacking attacks. To detect it, check if the web interface includes the X-Frame-Options header or Content-Security-Policy frame-ancestors directive. Use commands like curl -I http://<device-ip> to inspect HTTP headers for these security measures.

Impact Analysis

An attacker could manipulate an administrator into making unauthorized configuration changes or disruptive actions on the device, potentially leading to system misconfiguration or operational disruptions.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized configuration changes through clickjacking or similar attacks. An attacker could trick an authenticated administrator into performing unintended actions via a crafted webpage, which may lead to unauthorized data exposure or system modifications. This could violate confidentiality requirements under both regulations.

Mitigation Strategies

Immediately update the Ebyte device firmware to the latest version if available. Configure the web server to include X-Frame-Options: DENY or SAMEORIGIN headers. Restrict administrative access to trusted networks only. Monitor for unauthorized configuration changes.

Hi! I’m here to help you understand CVE-2026-75548. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70