Ebyte device web management interface does not consistently enforce
authentication before granting access to administrative functionality.
An unauthenticated remote attacker could access sensitive configuration
information, modify device settings, or disrupt availability.
Ebyte acknowledged receipt of the reported vulnerabilities and indicated
that a patch was under development. However, the vendor has not
responded to subsequent requests for coordination, and CISA has not been
informed of the status or availability of the patch. Users are
encouraged to reach out to Ebyte for more information.