CVE-2023-50614 is a high severity information exposure in the EBYTE E880-IR01 router, firmware V1.1, scored 7.5 by NVD. The management login sends the account name and password in cleartext. No fixed firmware is named, so contact EBYTE and keep the admin interface off untrusted networks.
What's affected
The NVD record names EBYTE E880-IR01 firmware V1.1. It says an attacker can obtain sensitive information through a crafted POST request to the /cgi-bin/luci path. The record is dated 2024-01-18.
NVD scores it 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. That is a confidentiality only impact: nothing in the record says the flaw changes settings or crashes the device.
The report linked from the record describes the same product and states that account credentials appear in cleartext in the login traffic to that path. It does not describe a fix or a patched version, and no vendor advisory is linked. Whether a later firmware changes this behavior is unconfirmed, so ask the vendor.
How to check if you're exposed
Check the firmware version on the device's status page. If it is E880-IR01-V1.1, it matches the record.
Then ask a practical question: does anyone log in to this device over a network you do not control? If the admin page is only reachable over a wired link in a locked cabinet, the risk of someone capturing the login is low. If it is reachable over Wi-Fi, a shared network or the internet, treat the credentials as exposed.
The same check applies to the password itself. If it was reused on other devices or systems, the exposure reaches further than the router.
What to do now
- Identify every E880-IR01 on your network and its firmware version.
- Change the admin password on affected devices, using a password that is not used anywhere else.
- Restrict the management interface to a trusted wired network or a VPN.
- Ask EBYTE whether a firmware release changes the login to an encrypted transport, and apply it if so.
- Replace the device if the vendor cannot offer a fix and it must be managed over untrusted links.
Why it matters
The weakness is cleartext transmission of sensitive information, CWE-319. When a login is sent over plain HTTP, anyone who can observe the traffic can read the credentials. That includes someone on the same Wi-Fi network, a compromised switch or an upstream provider.
Industrial and IoT routers often ship with the web interface on plain HTTP because certificate handling is hard on small devices. The result is that the one secret protecting the device is visible to anyone on the path.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and the fetched report does not claim exploitation in the wild.
Quick check
Is this a remote code execution flaw?
No. The record and the linked report describe an information exposure. The vector shows high confidentiality impact and no integrity or availability impact.
Does HTTPS fix it?
If the device offers an HTTPS management option and you use it, the credentials are no longer sent in cleartext. The sources do not say whether this firmware supports that, so confirm with the vendor.
Sources
Last reviewed: 19 October 2026.
