ICSA-26-239-05: Ebyte NA111-M Serial-to-Ethernet Gateway — 13 CVEs (CVSS 9.8) Allow Full Device Compromise

CISA has published ICS Advisory ICSA-26-239-05, disclosing thirteen distinct vulnerabilities in the Ebyte NA111-M serial-to-Ethernet gateway (Firmware 9013-2-17), carrying a CVSS v3 score of 9.8 (Critical). The affected CVEs are: CVE-2026-73125, CVE-2026-76179, CVE-2026-75814, CVE-2026-76940, CVE-2026-77966, CVE-2026-73809, CVE-2026-71187, CVE-2026-75548, CVE-2026-69658, CVE-2026-76133, CVE-2026-73819, CVE-2026-77975, and CVE-2026-77977. CISA's assessment is blunt: successful exploitation of these issues could allow an attacker to fully compromise the device.

If you've spent any time in OT environments, the Ebyte NA111-M profile will be familiar. These are inexpensive serial-to-Ethernet / Modbus TCP gateways that bridge RS-232/RS-485 serial field devices — PLCs, RTUs, meters, drives — onto IP networks. They sit at exactly the seam where your flat serial world meets your routable network. A fully compromised gateway at that seam is not a nuisance; it is a man-in-the-middle position over the commands flowing to physical process equipment.

Defenders need to act on three fronts immediately: inventory (do you have these devices, and where?), exposure (are they reachable from anywhere they shouldn't be?), and compensating controls (because embedded firmware patch cycles in this device class are historically slow).

Technical Analysis

Affected Products

• Vendor: Ebyte
• Product: Ebyte NA111-M serial-to-Ethernet / Modbus gateway
• Affected firmware: 9013-2-17
• CVSS v3: 9.8 (Critical)
• Advisory: ICSA-26-239-05

Vulnerability Classes

Per the advisory, the thirteen CVEs map to a grimly familiar set of embedded-device CWEs:

• Missing Authentication for Critical Function — administrative or configuration functions reachable without any credential challenge.
• Use of GET Request Method With Sensitive Query Strings — credentials or session material passed in the URL, meaning they land in proxy logs, browser history, and web server logs in cleartext.
• Cross-Site Request Forgery (CSRF) — an operator's authenticated browser session can be weaponized to make unauthorized configuration changes.
• Improper Restriction of Excessive Authentication Attempts — no lockout or throttling, enabling unrestricted online brute force against the management interface.
• Missing Authorization — authenticated low-privilege (or unauthenticated) requests can reach functions that should require elevated privilege.
• Cleartext Transmission of Sensitive Information — management traffic and/or credentials traversing the network unencrypted (HTTP, and on this device class commonly Telnet for configuration).
• Use of Client-Side Authentication — authentication decisions enforced in the browser/client, trivially bypassed by talking to the endpoint directly.
• Improper Restriction (truncated in the summary, consistent with the access-control failures above).

How Exploitation Works — Defender's View

The attack chain here requires no exotic tradecraft. An attacker with network reachability to the device's management interface can:

1. Bypass authentication entirely against critical functions (missing authN) or defeat the client-side auth check by crafting direct HTTP requests that skip the JavaScript-enforced login gate.
2. Where a login form does exist, brute force it without lockout, or harvest credentials from cleartext HTTP/Telnet sessions via passive sniffing or from proxy/firewall logs where GET query strings captured username=/password= parameters.
3. Use CSRF against an operator's browser to push malicious configuration changes (e.g., new credentials, altered serial-to-TCP mappings, modified Modbus gateway parameters) even if the device is otherwise "protected" by a logged-in session.
4. Once in control, reconfigure the gateway's serial bridging — redirecting, injecting, or dropping Modbus traffic between the control system and field devices. On a Modbus TCP gateway, that means arbitrary read/write of coils and holding registers on downstream serial slaves: setpoints, relay states, drive speeds.

The exploitation prerequisite is the same as it is for nearly every advisory in this class: network reachability. That is both the bad news (these devices are frequently deployed on flat OT networks) and the good news (segmentation is a fully effective compensating control you own today).

Exploitation Status

At the time of writing, the advisory does not report confirmed in-the-wild exploitation, and none of the listed CVEs appear on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, a 9.8-rated, no-authentication-required flaw set on an internet-searchable embedded device is exactly the profile that gets folded into opportunistic scanning and botnet tooling within weeks of disclosure. Treat "not yet exploited" as a window, not a comfort. Check the KEV catalog and the CSAF feed linked from the advisory regularly.

Detection & Response

Because the NA111-M is an embedded device, your detection surface is the network around it, not the device itself. The highest-fidelity signals are: cleartext HTTP management sessions carrying credentials in GET query strings, unauthenticated requests to administrative endpoints, brute-force authentication patterns, and unexpected hosts initiating connections to OT gateway management ports at all.

The rules below assume you are ingesting proxy/Zeek/firewall data (Sigma webserver/proxy log sources), and syslog/CEF into Sentinel. Scope destination indicators to your OT gateway subnet(s) — replace the example CIDRs with your actual asset ranges. Tight scoping is what keeps these rules alive instead of disabled.

---
title: Ebyte NA111-M Cleartext Credentials in HTTP GET Query String
id: 3c8a1f42-7b2d-4e91-a6c5-9f0d2e4b8a17
status: experimental
description: Detects HTTP GET requests carrying credential-like parameters in the query string destined for OT serial-to-Ethernet gateways such as the Ebyte NA111-M, consistent with CVE-class 'Use of GET Request Method With Sensitive Query Strings' and 'Cleartext Transmission of Sensitive Information' from ICSA-26-239-05.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-05
  - https://attack.mitre.org/techniques/T1040/
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/08/27
tags:
  - attack.collection
  - attack.credential_access
  - attack.t1040
  - attack.t1552
logsource:
  category: proxy
detection:
  selection_dst:
    dst_ip|cidr:
      - '10.90.0.0/16'  # REPLACE: your OT/gateway asset range
  selection_query:
    url_query|contains:
      - 'passwd='
      - 'password='
      - 'pwd='
      - 'pass='
      - 'user='
      - 'username='
      - 'loginname='
  filter_scheme:
    url_scheme: 'https'
  condition: selection_dst and selection_query and not filter_scheme
falsepositives:
  - Legitimate device administration over cleartext HTTP (itself a finding — validate and remediate)
level: high
---
title: Ebyte NA111-M Management Interface Brute Force Attempts
id: 8e2b5d61-4c9a-4f37-b812-6a1d3c7e9f05
status: experimental
description: Detects high-volume repeated HTTP authentication requests against OT gateway management interfaces, consistent with exploitation of 'Improper Restriction of Excessive Authentication Attempts' (no lockout) disclosed in ICSA-26-239-05.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-05
  - https://attack.mitre.org/techniques/T1110/
author: Security Arsenal
date: 2026/08/27
tags:
  - attack.credential_access
  - attack.t1110
logsource:
  category: webserver
detection:
  selection:
    cs_uri_stem|contains:
      - '/login'
      - '/auth'
      - '/goform/'
      - '/cgi-bin/'
    sc_status:
      - 401
      - 403
  condition: selection | count(cs_uri_stem) by c_ip, s_ip > 25
 timeframe: 5m
falsepositives:
  - Misconfigured monitoring or polling tools repeatedly hitting the management interface
level: high
---
title: Unauthenticated Administrative Request to OT Gateway Management Endpoint
id: 5f1a9c73-2e84-4b56-9d21-8c3b6f0a4e92
status: experimental
description: Detects direct HTTP requests to administrative/configuration endpoints on OT serial gateways without an authenticated session or from non-engineering-workstation sources, consistent with 'Missing Authentication for Critical Function' and 'Missing Authorization' from ICSA-26-239-05.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-05
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/27
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: proxy
detection:
  selection_dst:
    dst_ip|cidr:
      - '10.90.0.0/16'  # REPLACE: your OT/gateway asset range
  selection_method:
    http_method:
      - 'POST'
      - 'PUT'
  selection_path:
    url_path|contains:
      - '/goform/'
      - '/cgi-bin/'
      - '/config'
      - '/system'
      - '/passwd'
  filter_authorized_src:
    src_ip|cidr:
      - '10.10.20.0/24'  # REPLACE: engineering workstation / jump host range
  condition: selection_dst and selection_method and selection_path and not filter_authorized_src
falsepositives:
  - Legitimate configuration pushes from unauthorized-but-benign tools (tune source allowlist)
level: critical

For Microsoft Sentinel, the equivalent hunt over ingested firewall/proxy CEF data — looking for any north-south session to OT gateway management ports from outside the authorized engineering zone:

// Hunt: Inbound management-plane connections to OT serial gateways (Ebyte NA111-M class)
// Scope the gateway range and authorized engineering sources to your environment.
let GatewayRange = "10.90.0.0/16";        // REPLACE: OT gateway subnet
let AuthorizedSrc = "10.10.20.0/24";      // REPLACE: engineering workstation/jump-host range
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where ipv4_is_in_range(DestinationIP, GatewayRange)
| where DestinationPort in (80, 443, 23, 8080, 502)   // HTTP mgmt, Telnet, alt-HTTP, Modbus TCP
| where not(ipv4_is_in_range(SourceIP, AuthorizedSrc))
| where DeviceAction !in ("deny", "drop", "blocked")  // sessions that were permitted
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
            ConnectionCount=count(), Ports=make_set(DestinationPort),
            Actions=make_set(DeviceAction)
  by SourceIP, DestinationIP
| order by ConnectionCount desc;

For environments where you can run Velociraptor on Windows jump hosts or engineering workstations adjacent to the OT zone, hunt for unexpected Telnet/HTTP tooling sessions to gateway subnets — a strong post-compromise signal since legitimate gateway administration should only ever originate from a small, known set of hosts:

-- Hunt for live outbound connections from engineering workstations/jump hosts
-- to OT gateway management ports (HTTP alt-ports, Telnet) on the NA111-M subnet.
-- Replace the regex with your OT gateway subnet.
SELECT Pid, Name, Path, Address, Status,
       process.Username AS Username,
       process.CommandLine AS CommandLine
FROM netstat()
JOIN (SELECT Pid AS Pid2, Username, CommandLine FROM pslist())
  ON Pid = Pid2
WHERE Address =~ '10\\.90\\.'          -- REPLACE: OT gateway subnet regex
  AND Status =~ 'ESTABLISHED|SYN'

The Bash script below gives you a fast, repeatable audit of NA111-M exposure: it sweeps for live web/Telnet management surfaces in your OT ranges, fingerprints Ebyte-style web banners, and verifies that your boundary ACLs actually deny management ports from untrusted zones. Run it from a scanning host with routes into the OT network, or from the OT-side jump host:

#!/bin/bash
# ebyte_na111m_exposure_audit.sh
# Audit for exposed Ebyte NA111-M-class serial gateways (ICSA-26-239-05)
# Usage: sudo ./ebyte_na111m_exposure_audit.sh 10.90.0.0/16

TARGET_RANGE="${1:?Usage: $0 <CIDR range of OT gateway subnet>}"
OUTDIR="na111m_audit_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTDIR"

echo "[*] Sweeping $TARGET_RANGE for management surfaces (80, 443, 23, 8080)..."
nmap -Pn -p 80,443,23,8080 --open -oG "$OUTDIR/nmap_sweep.gnmap" "$TARGET_RANGE"

echo "[*] Fingerprinting HTTP banners for Ebyte NA111 indicators..."
awk '/80\/open/ {print $2}' "$OUTDIR/nmap_sweep.gnmap" | sort -u > "$OUTDIR/http_hosts.txt"
while read -r host; do
  banner=$(curl -sk --max-time 5 "http://$host/" | tr -d '\0' | head -c 2000)
  if echo "$banner" | grep -qiE 'ebyte|na111|serial|modbus'; then
    echo "[!] POSSIBLE EBYTE DEVICE: $host"
    echo "$host" >> "$OUTDIR/suspect_devices.txt"
  fi
  # Flag cleartext GET-based auth forms (credentials in query string pattern)
  if echo "$banner" | grep -qiE 'method="?get"?.*(pass|pwd|user)'; then
    echo "[!] GET-based auth form (cleartext creds in URL) on: $host"
    echo "$host" >> "$OUTDIR/get_auth_devices.txt"
  fi
done < "$OUTDIR/http_hosts.txt"

echo "[*] Checking for Telnet (23) listeners — cleartext management exposure..."
awk '/23\/open/ {print $2}' "$OUTDIR/nmap_sweep.gnmap" | sort -u | tee "$OUTDIR/telnet_devices.txt"

echo "[*] Verifying boundary ACL denies management ports from untrusted zone..."
echo "    (Run on your boundary firewall/router — example nftables check:)"
echo "    nft list ruleset | grep -E 'dport (80|23|8080).*drop'"

echo "[*] Audit complete. Results in $OUTDIR/"
echo "    - suspect_devices.txt   : devices matching Ebyte/serial banners"
echo "    - get_auth_devices.txt  : devices leaking creds via GET query strings"
echo "    - telnet_devices.txt    : devices with Telnet exposed (disable immediately)"

Remediation

1. Inventory first. Sweep every OT VLAN for the NA111-M and confirm firmware version 9013-2-17. These devices are frequently installed by integrators and forgotten — assume shadow deployments exist. The script above is a starting point; cross-reference against procurement and integrator records.

2. Isolate the management plane — today. This is your primary compensating control and it fully breaks the documented attack chain:

• NA111-M management interfaces (HTTP/HTTPS, Telnet if present) must be reachable only from a dedicated engineering workstation or jump host VLAN. Deny all other sources at the boundary firewall.
• Disable Telnet entirely if enabled. It is cleartext by design and compounds the cleartext-transmission CVEs.
• Modbus TCP (502) should only be reachable from the specific SCADA/HMI hosts that poll through the gateway — nothing else.
• Confirm zero internet exposure: check Shodan/Censys for your public ranges and verify no NAT rules or port forwards reach these devices.

3. Apply vendor firmware updates when available. Monitor the CSAF document linked from ICSA-26-239-05 and Ebyte's official channels for fixed firmware. Given thirteen CVEs spanning the entire authentication and session-management stack, treat any partial fix as incomplete and validate which CVEs are actually remediated before relaxing compensating controls.

4. Mitigate CSRF and credential exposure operationally. Until patched: perform all device administration from a dedicated, hardened browser profile used for nothing else (no general web browsing = no CSRF delivery vector); change any credentials that have ever traversed HTTP or appeared in GET query strings — assume they are compromised and check proxy logs for historical leakage; and enforce strong unique passwords since there is no brute-force lockout to protect weak ones.

5. Log and alert. Ensure firewall, proxy, and any OT-aware IDS (Zeek/Suricata) telemetry for the gateway subnets is flowing to your SIEM so the detections above fire. Deploy the Sigma rules with your asset ranges substituted, and add these CVEs to your vulnerability management platform as a tracked finding with a defined remediation SLA per your OT risk policy.

6. Report and track. CISA encourages organizations to report suspected exploitation via its incident reporting channels, and to follow the defensive measures in the advisory. If you operate critical infrastructure, fold this advisory into your next OT risk review — a 9.8 on a device bridging to physical process equipment is a board-level conversation if it sits on a flat network.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub