CVE-2026-75548
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Ebyte device web management interface does not restrict rendering within an external frame (clickjacking). An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into unintended configuration changes or disruptive actions.
Risk Assessment
Risk of unauthorized configuration changes or disruption of device operations, potentially compromising integrity and availability.
Recommendation
Implement X-Frame-Options or Content-Security-Policy frame-ancestors headers to prevent framing of the interface.
Original NVD description (English source)
The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into initiating unintended configuration changes or disruptive actions.