The affected Ebyte
product
uses a deprecated hashing algorithm in an authentication-related
operation. Under conditions where an attacker can manipulate or predict
the authentication exchange, the weak construction may reduce the
assurance provided by the authentication mechanism and facilitate
unauthorized access.
Ebyte acknowledged receipt of the reported vulnerabilities and indicated
that a patch was under development. However, the vendor has not
responded to subsequent requests for coordination, and CISA has not been
informed of the status or availability of the patch. Users are
encouraged to reach out to Ebyte for more information.