Ebyte NE2-D11 CVE-2026-73819

Exploitation requires adjacent-network (same layer-2 segment / directly reachable) access to the Ebyte NE2-D11's vendor configuration utility management interface - the description states the attacker must be 'on the adjacent network', limiting exploitation to actors already inside the device's network segment rather than the open internet. No valid administrator authentication is needed (PR:N, unauthenticated) and no user interaction is required (UI:N), but the flaw only manifests 'under certain credential conditions', so the specific credential state of the target device (for example default, unset, or a particular provisioning state) is a limiting prerequisite. The practical limiting factors are therefore network adjacency to the management interface and the device being in the vulnerable credential condition.

This is a high-severity issue (CVSS 4.0 base 9.3) but with an important caveat: the supplied CVSS 4.0 vector encodes AV:N (network) while the description explicitly says the attacker must be 'on the adjacent network', which corresponds to AV:A - verify true reachability with the vendor/CISA advisory, because AV:A materially narrows the attacker population to those with layer-2/segment adjacency. Beyond the vector conflict, PR:N/UI:N and AC:L indicate a trivially triggerable, unauthenticated attack with no user interaction, and VC:H/VI:H/VA:H reflect full compromise of the device's confidentiality, integrity, and availability. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation yet; the practical priority is high for exposed OT segments but tempered by the adjacent-network requirement and the 'under certain credential conditions' qualifier, which suggest exploitation is not universal across every deployment.

An attacker who gains a foothold on the same OT network segment as an NE2-D11 (for example via a compromised HMI or engineering laptop) opens the vendor configuration utility against the device and is granted administrative access without valid authentication. They then change the device's access credentials and critical settings, locking out the plant's administrators and taking control of the device's communication behavior. No public exploit code is currently identified, and the low attack complexity means the action requires no special tooling once segment access is achieved.