CISA Slaps a 9.8 on the Serial Server Next to Your 3D Printer: Ebyte NA111-M, 13 CVEs, Six of Them Critical

The short version//

If you've soldered an RS485 cable into a $30 gateway so a PLC, a 3D printer, or a smart e-bike could talk to your network, CISA just rated it 9.8. The advisory (ICSA-26-239-05, published 2026-08-27) covers the Ebyte NA111-M, the DC-powered single-port RS485-to-Ethernet serial server that shows up all over homelab builds. Thirteen CVEs on firmware 9013-2-17, six of them CVSS 9.8 (writer's flag: the research brief said three 9.8s; the advisory's own metric tables score six: 73125, 76179, 71187, 69658, 76133, 73819 — I trusted the source), and CISA's summary line is blunt: "Successful exploitation of these vulnerabilities could allow an attacker to fully compromise the device."

No known public exploitation yet. Which means you're in the best window you're ever going to get: it's rated, it's documented, and nobody has knocked on the door in public. That window closes when someone does.

What the NA111-M is (if you don't own one)//

For non-OT people: a serial server is a tiny box with an Ethernet port on one side and a serial port (here, RS485) on the other. It exists because a lot of the world's machinery still speaks Modbus over RS485 — a 1979-era serial protocol — and you'd rather put that machine on your IP network than run a serial cable to a laptop. The NA111-M adds an MQTT bridge on top: the serial traffic can also be pushed as MQTT messages to a broker, which is how it feeds home SCADA, Grafana dashboards, and "my printer posts its temperatures to InfluxDB" setups.

The price is the insult: the same box lists at $11.27 on Ebyte's own store and sells in the $20–40 range on Amazon and eBay. It is, by design, the cheapest possible way to put a serial device on a network. Cheap gear with an admin web UI is a well-known trouble combo, but this one is worse than "trouble combo."

The six 9.8s, in plain English//

The headline vulnerabilities, all on firmware 9013-2-17:

CVE	What it is, translated
CVE-2026-73125	The web admin interface doesn't consistently enforce authentication — an unauthenticated remote attacker can read config, change settings, or disrupt the device. The front door is unlocked.
CVE-2026-71187	The auth logic is client-side and reproducible — an attacker can generate a valid auth request themselves and bypass authentication to get admin access. The "lock" is a suggestion the client makes.
CVE-2026-76179	Session tokens are inadequately protected during client-side handling (CISA tags it CWE-598, sensitive data in GET query strings) — an attacker who sees an exposed session can steal and reuse a valid token and impersonate an authenticated admin.
CVE-2026-69658	MQTT credentials and control traffic go out in cleartext — anyone on the network path can read the broker password and the device's messages, impersonate the device, or disrupt its messaging. For a box whose entire job is publishing sensor data, this is the whole job.
CVE-2026-76133	A deprecated hashing algorithm in the auth path — if an attacker can manipulate or predict the auth exchange, the weak construction lowers the bar to unauthorized access. Old crypto, doing new work.
CVE-2026-73819	The vendor config utility lets an unauthenticated attacker on an adjacent network touch admin functions under certain credential conditions — change critical settings or reset your access credentials so the real admin can't get back in.

That's an unauthenticated and an authenticated attacker, plus a network-level attacker, plus a same-switch attacker, all on one $30 box.

The other seven (one line, as promised)//

CSRF against the admin interface (CVE-2026-75814, 8.8), no rate-limiting or lockout on login attempts (CVE-2026-76940, 7.5), a low-privilege user reaching admin functions (CVE-2026-77966, 8.8), cleartext transport for the web admin session (CVE-2026-73809, 7.5), an adjacent-network factory reset via the config utility when default credentials are still set (CVE-2026-77977, 8.1 — someone on your switch can reboot or factory-reset your box with no auth), config exports that include admin credentials in the clear (CVE-2026-77975, 6.5), and clickjacking via unrestricted frame rendering (CVE-2026-75548, 5.4). The full advisory has vectors for every one.

Who's exploiting it (spoilery: nobody in public yet)//

CISA: "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time." Reported by Jithin Nambiar J. The sector on the advisory is Information Technology; deployment is worldwide; the vendor is in China. Read that the way you'd read any ICS advisory we've covered — same shape as the Siemens S7 AI-exploit story: the devices are cheap, the devices are everywhere, and the protocols are older than most of your routers.

What you should do//

1. Find your NA111-Ms. arp -a, your DHCP client table, or the vendor utility — they announce themselves. Then check the firmware version; if it's 9013-2-17 (which is effectively "all of them at this point"), you're in scope.
2. VLAN it off the main LAN. The serial server's entire world is the serial device on its other end. Give it its own VLAN, and let only the broker or the SCADA box talk to it.
3. Kill the default credentials — and note CVE-2026-77977 means the factory-reset bug worsens while defaults are still configured. Change them first.
4. Prefer the wired/MQTT-TLS path for anything sensitive — cleartext MQTT (CVE-2026-69658) is the one that makes "it's just a temperature sensor" a lie.
5. Don't run the vendor config utility on an untrusted segment — it's the trigger for two of the adjacent-network bugs.
6. Treat your config exports as secrets — they carry admin credentials in cleartext (CVE-2026-77975).
7. Watch for a firmware release past 9013-2-17 and re-read the advisory when it lands. If you can't segment it, the honest fallback is a VPN or IP allowlist in front of the admin UI, or a different gateway.