The affected Ebyte
product exports administrative credentials and other
sensitive configuration information without adequate protection. An
unauthenticated attacker on the adjacent network who can obtain an
exported configuration file could recover valid credentials and use them
to access the device or similarly configured systems.
Ebyte acknowledged receipt of the reported vulnerabilities and indicated
that a patch was under development. However, the vendor has not
responded to subsequent requests for coordination, and CISA has not been
informed of the status or availability of the patch. Users are
encouraged to reach out to Ebyte for more information.