CVE-2026-75548

MediumCVSS 5.4/10Last modified Aug 31, 2026

Description

The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into initiating unintended configuration changes or disruptive actions.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
Ebyte	Ebyte NA111-M Firmware	9013-2-17

References

Timeline

Published: Aug 28, 2026
Last modified: Aug 31, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-75557.3A vulnerability was identified in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/login.php. S CVE-2026-755532.4Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a CVE-2026-755542.3Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to CVE-2026-755585.3The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicate CVE-2026-755596.9The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included i CVE-2026-75567.2The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in all versions up to,CVE-2026-755697.7A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrit CVE-2026-75579.1An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3 CVE-2026-755735.5In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the CVE-2026-755748.8The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig te CVE-2026-755755.3Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often CVE-2026-755767.2Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root vi