CVE-2026-73819

Deferred Deferred - Pending Action

Ebyte Vendor Utility Authentication Bypass

Publication date: 2026-08-31

Last updated on: 2026-09-01

Assigner: ICS-CERT

Description

The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials, potentially preventing legitimate administrators from managing the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-09-01

Generated

2026-09-20

AI Q&A

2026-08-31

EPSS Evaluated

2026-09-15

NVD

CVE-2026-73819

EUVD

EUVD-2026-68610

Affected Vendors & Products

Vendor	Product	Version / Range
ebyte	csafpid-0001	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1390	The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Attack-Flow Graph

Executive Summary

This vulnerability allows unauthenticated attackers on the same network to access administrative functions of the Ebyte product's vendor configuration utility without proper identity verification. This could let them modify critical settings or change access credentials, potentially locking out legitimate administrators.

Detection Guidance

This vulnerability involves unauthenticated access to administrative functions in Ebyte products. Detection requires checking for unauthorized changes in device configurations or credentials. Monitor network traffic for plaintext credential exposure or unencrypted administrative sessions. Inspect device logs for unusual administrative access attempts from adjacent networks.

Impact Analysis

An attacker could take control of the device, alter its configuration, or change credentials, preventing authorized users from managing it. This may lead to unauthorized access, data breaches, or device malfunction, depending on the device's role in your system.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality and integrity requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, fines, or reputational damage due to inadequate access controls.

Mitigation Strategies

Isolate affected devices from untrusted networks, update firmware if available, and restrict access to administrative functions to trusted users only.

Hi! I’m here to help you understand CVE-2026-73819. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70