Ebyte NE2-D11 CVE-2026-73809

The attacker must be capable of intercepting HTTP traffic between a client workstation and the NE2-D11 management interface - achievable by being on the same Layer 2 network segment, executing ARP cache poisoning, or compromising an upstream switch or router. No authentication is required on the attacker's side (CVSS PR:N). Exploitation is limited to environments where the web management interface is reachable over the network; if management is restricted to a local serial/console interface only, this attack vector does not apply. The CVSS 4.0 vector carries UI:N, meaning exploitation does not require any specific user action beyond normal administrative use of the interface. No special non-default configuration is required - any deployment using the web management interface over a non-encrypted channel is affected.

The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N/VC:H reflects vendor and CISA consensus that this is straightforward network-level exploitation with high confidentiality impact. The practical limiting factor is that the attacker must be positioned to intercept traffic - either on the same LAN segment, via ARP poisoning, or through a compromised upstream device. In OT environments, this constraint is frequently weaker than in segmented enterprise networks, making the AC:L assessment appropriate for the target deployment context. There is no EPSS data provided, no CISA KEV listing, and no public POC, which reduces the probability of opportunistic automated exploitation. However, the ICS context and the 'Authentication Bypass' tag in the intelligence data suggest that credential capture leads directly to management-plane compromise - a meaningful lateral movement path in industrial environments. The wildcard CPE version range means no specific firmware versions are confirmed safe, making triage dependent on whether a patched release exists (not yet confirmed). CVSS indicates no integrity or availability impact, consistent with a passive eavesdropping vulnerability that itself does not alter device state.

An attacker positioned on the same network segment as the Ebyte NE2-D11 deploys a passive packet capture tool and waits for a legitimate operator to authenticate to the device's web management interface; the HTTP session transmits credentials in cleartext, which are captured without any active interference. The attacker replays or directly uses the harvested credentials to log into the management interface and reconfigure gateway routing, disable alarms, or pivot to connected OT assets. No public exploit code has been identified at time of analysis, but this attack requires only commodity network capture tooling.