CVE-2026-71187

9.3 criticalEPSS 0.8%

Critical (9.3). EPSS 0.8% chance of exploitation in the next 30 days.

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-603
Published: 2026-08-28
Modified: 2026-08-31
Record from: the NVD, synced 2026-10-19

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06

Check your stack JSON