EUVD-2026-67277
GHSA-h7m6-87m3-q5r3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device management interface over network
-
DeliverySend request to admin endpoint
-
ExploitBypass missing authentication check
-
ExecutionRead/modify device configuration
-
ImpactDisrupt device availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network access to the Ebyte NE2-D11 web management interface - no credentials, no user interaction, and no special configuration, consistent with AV:N/AC:L/AT:N/PR:N/UI:N. The affected administrative functionality is exposed by the device's default web interface; the CWE-306 flaw means the normal login gate does not consistently apply. The primary limiting factor is network exposure: these OT/serial-networking devices are typically deployed on internal or segmented control networks, so an attacker must already have a route to the device's management port. There is no platform or version qualifier available beyond the affected NE2-D11 firmware, and no non-default setting is required to trigger the bypass. |
| Impact | The vendor CVSS 4.0 base score is 9.3 (Critical) with vector AV:N/AC:L/AT:N/PR:N/UI:N and high confidentiality, integrity, and availability impact to the vulnerable system (VC:H/VI:H/VA:H), meaning network-reachable, low-complexity, unauthenticated exploitation with no user interaction - the highest-risk signal profile. There is no EPSS score, no CISA KEV listing, and no POC referenced in the provided data, so active exploitation is not confirmed; the severity rests on the CVSS profile and the intrinsic simplicity of an auth-bypass. The signals are internally consistent (network auth-bypass matches PR:N and the description), so this is a genuine high priority for any exposed device, tempered by the fact that these OT devices are usually deployed on segmented/internal networks rather than the public internet, which limits real-world attack surface. |
| Exploit ScenarioDerived | An attacker with network reachability to the device sends a direct HTTP request to an administrative endpoint of the NE2-D11 web interface, bypassing the login page entirely. They read the device configuration to harvest sensitive settings, then alter parameters or reboot/reconfigure the device to disrupt the industrial serial link it serves. Given AV:N/AC:L/PR:N/UI:N, no credentials, no user interaction, and no special tooling are required; no public POC is currently referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 28, 2026
Authentication bypass in the Ebyte NE2-D11 firmware web management interface lets unauthenticated remote attackers reach administrative functions that should be gated behind login. The interface fails to consistently enforce authentication, exposing sensitive device configuration for reading, tampering, and denial of service. No public exploit identified at time of analysis, but the flaw is trivially reachable over the network and was disclosed via a CISA ICS advisory (ICSA-26-237-06).
Earlier versions of this analysis (1)
Authentication bypass in the Ebyte NE2-D11 firmware's web management interface lets unauthenticated remote attackers reach administrative functions directly, exposing sensitive device configuration, permitting settings tampering, and enabling denial of service. The flaw affects this Ebyte industrial serial-to-Ethernet device server and was disclosed via CISA ICS-CERT advisory ICSA-26-237-06. No public exploit identified at time of analysis, though the missing-auth root cause is trivially reachable given a full-critical CVSS of 9.8.
RemediationAI
No vendor-released patch version was identified in the provided data; consult CISA advisory ICSA-26-237-06 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06) and its CSAF record for any firmware update Ebyte has published and apply it once confirmed. As compensating controls: remove the device's web management interface from any untrusted or internet-facing network and restrict it to a dedicated management VLAN reachable only by trusted administrator hosts (trade-off: administrators must be on that segment or use a jump host); place the device behind a firewall that blocks inbound access to its HTTP/management port from general network zones (trade-off: legitimate remote management is also blocked and must go through a VPN); and monitor the management interface for unexpected configuration changes. Because the flaw is an authentication bypass, host-level ACLs and network segmentation are the most reliable mitigations until a fixed firmware is confirmed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded web management interface of the Ebyte NE2-D11, a serial-to-Ethernet/industrial networking device (CPE cpe:2.3:a:ebyte:ebyte_ne2-d11_firmware). The root cause is CWE-306 (Missing Authentication for a Critical Function): administrative endpoints do not consistently verify that a request carries a valid authenticated session before serving configuration data or accepting changes. In embedded OT devices this class of flaw typically arises when specific handler routes or API paths are not wrapped by the same session-check middleware as the login-protected pages, leaving a parallel unauthenticated path to privileged functionality.
Know when Ebyte Ne2 D11 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network-reachable auth bypass with no user interaction (AV:N/AC:L/PR:N/UI:N) granting full read, modify, and disrupt control over the device, so C/I/A all High.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability.
Executive ViewAI
Ebyte NE2-D11 network devices contain a critical authentication bypass vulnerability enabling unauthenticated remote attackers to access administrative controls and modify device configurations without credentials. Organizations deploying these devices for network infrastructure or operational technology face immediate risk of network compromise, configuration tampering, and service disruption. The CISA ICS advisory designation reflects the severity to industrial and critical infrastructure environments.
No vendor-released patch identified at time of analysis. Implement these interim mitigations: (1) Enforce strict firewall rules permitting management access only from trusted administrative subnets; (2) Isolate devices on dedicated network segments to contain potential lateral movement; (3) Enable detailed logging and alerting on all configuration changes and management interface access; (4) Deploy network intrusion detection signatures to identify exploitation attempts; (5) Establish direct communication with Ebyte support to track patch release and interim workaround availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Ebyte Ne2 D11 Firmware
View allAuthentication bypass in the Ebyte NE2-D11 network device's vendor configuration utility allows an unauthenticated attac
Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gai
Authentication token theft and session impersonation affects the web management interface of Ebyte NE2-D11 industrial ga
Authentication weakness in Ebyte NE2-D11 firmware stems from use of a deprecated hashing algorithm in an authentication-
Cleartext transmission of MQTT credentials and control traffic in Ebyte NE2-D11 firmware allows network-positioned attac
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication sta
Unrestricted authentication attempts in Ebyte NE2-D11 firmware expose password-protected deployments to automated brute-
Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface e
Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote att
Unauthenticated reboot and factory-reset of Ebyte NE2-D11 gateways is possible from the adjacent network when default cr
Credential exposure in Ebyte NE2-D11 firmware allows an unauthenticated adjacent-network attacker to recover administrat
Exploit-DB