Thirteen CVEs land on the Ebyte NA111-M while the vendor stops answering CISA

The authentication bypass carries the whole advisory. CISA's description is a web management interface that does not consistently enforce authentication before granting access to administrative functionality, and an unauthenticated remote attacker who finds it can read sensitive configuration, change device settings, or knock the device offline ^[3]. That is game over on its own.

The other defects matter because they describe what happens in the deployments where the front door does hold. Four of the five weakness classes written up in the advisory produce administrative effect without the attacker holding valid credentials ^[14]. Session tokens are insufficiently protected in client-side handling, so anyone who can see exposed session data can replay a valid token and act as the logged-in administrator, which CISA files under CWE-598, use of GET requests with sensitive query strings ^[4]. A token carried in a URL survives wherever URLs survive, and reverse proxy logs and browser history are not managed as secret stores. Requests are not checked for origin or authenticity, so a crafted page visited by a signed-in admin makes the configuration change on the attacker's behalf ^[5]. Repeated authentication attempts are neither rate limited nor subject to lockout, which is what turns a password-only deployment into a scripting exercise ^[6]. The fifth class needs an account first: limited and administrative management functions are not separated, so a low-privileged authenticated user reaches security-sensitive configuration ^[7].

In the advisory text as supplied, each vulnerability's Metrics heading appears with no CVSS values attached ^[12]. Operationally that absence costs nothing. An unauthenticated administrative path on a network-facing management interface sits at the top of the exploitability order whatever number is bolted on later.

CISA's own wording calls this a gateway product ^[11], and the background section lists the sector as Information Technology, deployment worldwide, vendor headquarters in China ^[10]. A box bought to bridge two networks is a poor candidate for a standing trust exception on either side of the bridge.

So the work is topology, because topology is the only control here that does not depend on Ebyte: the management interface off any routable path from user networks and the internet; admin access from a host that does not also browse the web, since the CSRF path targets the browser rather than the device; credentials that appear nowhere else in the estate, on the assumption that guessing is free; and change detection on the configuration itself, because every failure mode listed writes as well as reads ^[3].

Until a firmware build later than 9013-2-17 exists with a changelog naming these CVE identifiers ^[1], the only variable an owner controls is what the device can reach.