EUVD-2026-68610
GHSA-qww8-jv59-fcxh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description says 'adjacent network' so AV:A not AV:N; no auth or interaction needed (PR:N/UI:N/AC:L); admin bypass yields full C/I/A impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
5DescriptionCVE.org
The affected Ebyte
product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials, potentially preventing legitimate administrators from managing the device.
AnalysisAI
Authentication bypass in the Ebyte NE2-D11 network device's vendor configuration utility allows an unauthenticated attacker on the adjacent network to reach administrative functions without proving the operator's identity. Under certain credential conditions the attacker can alter critical device settings or change access credentials, locking legitimate administrators out of their own OT/ICS equipment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires adjacent-network (same layer-2 segment / directly reachable) access to the Ebyte NE2-D11's vendor configuration utility management interface - the description states the attacker must be 'on the adjacent network', limiting exploitation to actors already inside the device's network segment rather than the open internet. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a high-severity issue (CVSS 4.0 base 9.3) but with an important caveat: the supplied CVSS 4.0 vector encodes AV:N (network) while the description explicitly says the attacker must be 'on the adjacent network', which corresponds to AV:A - verify true reachability with the vendor/CISA advisory, because AV:A materially narrows the attacker population to those with layer-2/segment adjacency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched firmware version is confirmed in the available data, so the fixed version must be obtained from the CISA ICS advisory ICSA-26-237-06 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06) and the corresponding CSAF file - apply the Ebyte-published firmware update if one is listed there. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Ebyte NE2-D11 devices in production environments and implement firewall rules to restrict configuration utility access from untrusted network segments; document current administrator credentials in a secure vault for rapid rotation if compromise is suspected. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ebyte Ne2 D11 Firmware
View allAuthentication bypass in the Ebyte NE2-D11 firmware web management interface lets unauthenticated remote attackers reach
Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gai
Authentication token theft and session impersonation affects the web management interface of Ebyte NE2-D11 industrial ga
Authentication weakness in Ebyte NE2-D11 firmware stems from use of a deprecated hashing algorithm in an authentication-
Cleartext transmission of MQTT credentials and control traffic in Ebyte NE2-D11 firmware allows network-positioned attac
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication sta
Unrestricted authentication attempts in Ebyte NE2-D11 firmware expose password-protected deployments to automated brute-
Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface e
Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote att
Unauthenticated reboot and factory-reset of Ebyte NE2-D11 gateways is possible from the adjacent network when default cr
Credential exposure in Ebyte NE2-D11 firmware allows an unauthenticated adjacent-network attacker to recover administrat
Same weakness CWE-1390 – Weak Authentication
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today