Ebyte gateway product's vendor configuration utility does not require authentication before
allowing certain disruptive administrative actions when default
c…
The affected Ebyte device relies on client-managed authentication tokens
without sufficient server-side validation. An attacker may replay or
manipulate auth…
The affected Ebyte device does not restrict repeated authentication
attempts through rate limiting or account lockout mechanisms. This could
allow an attacke…
An improper protection of authentication tokens vulnerability exists in
certain Ebyte gateway products. Authentication tokens used by the web
management inte…
The Ebyte device does not adequately verify the origin or authenticity of
requests submitted to the web management interface. An unauthenticated
remote attac…
Certain configuration endpoints may lack proper server-side
authorization checks, allowing unauthorized users to access or modify
sensitive device settings…
The affected Ebyte device web management interface does not restrict the
interface from being rendered within an external frame. An
unauthenticated remote at…
Administrative credentials may be exposed in plaintext within the Ebyte
device's management interface, increasing the risk of credential
compromise through v…
A cleartext transmission of sensitive information vulnerability exists
in certain Ebyte gateway products. The web management interface does not
adequately pr…
Ebyte device web management interface does not consistently enforce
authentication before granting access to administrative functionality.
An unauthenticated…
MQTT credentials and control traffic are transmitted in cleartext,
exposing sensitive information to network-level attackers. This may
enable unauthorized de…