Skip to main content

Ebyte NE2-D11 CVE-2026-73839

| EUVDEUVD-2026-67281 MEDIUM
Insufficiently Protected Credentials (CWE-522)
2026-08-27 icscert GHSA-gv76-7x3r-m8gf
Information Disclosure Ebyte Ne2 D11 Firmware
5.1
CVSS 4.0 · Vendor: icscert
Share

Severity by source

Vendor (icscert) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.6 MEDIUM

Physical proximity required to view management interface; PR:N because viewing is passive with no prior authentication; only confidentiality is impacted as no write capability or service disruption is described.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
CVSS changed
Aug 28, 2026 - 00:22 NVD
4.6 (MEDIUM) 5.1 (MEDIUM)
Analysis Generated
Aug 28, 2026 - 00:11 vuln.today

DescriptionCVE.org

Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the risk of credential compromise through visual or remote observation. This undermines the confidentiality of device access.

AnalysisAI

Plaintext administrative credential exposure in the Ebyte NE2-D11 firmware management interface allows anyone with physical access to directly observe device credentials without any authentication or tooling. Reported by ICS-CERT under advisory ICSA-26-237-06, the flaw (CWE-522) affects all known firmware versions per CPE data, with a physical attack vector (AV:P) confirming that exploitation requires proximity to the device. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Physical proximity to the Ebyte NE2-D11 device is required, confirmed by the CVSS AV:P (Physical) metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.6 base score with AV:P (Physical) accurately reflects a constrained but real threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Consult CISA ICS Advisory ICSA-26-237-06 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06) for vendor patch guidance; an exact patched firmware version is not independently confirmed from available intelligence, so patch availability per vendor advisory should be verified directly with Ebyte. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ebyte Ne2 D11 Firmware

View all
CVE-2026-73125 CRITICAL
9.3 Aug 27

Authentication bypass in the Ebyte NE2-D11 firmware web management interface lets unauthenticated remote attackers reach
CVE-2026-71187 CRITICAL
9.3 Aug 27

Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gai
CVE-2026-76179 CRITICAL
9.3 Aug 27

Authentication token theft and session impersonation affects the web management interface of Ebyte NE2-D11 industrial ga
CVE-2026-69658 CRITICAL
9.3 Aug 27

Cleartext transmission of MQTT credentials and control traffic in Ebyte NE2-D11 firmware allows network-positioned attac
CVE-2026-76945 HIGH
8.7 Aug 27

Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication sta
CVE-2026-76940 HIGH
8.7 Aug 27

Unrestricted authentication attempts in Ebyte NE2-D11 firmware expose password-protected deployments to automated brute-
CVE-2026-75813 HIGH
8.7 Aug 27

Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows
CVE-2026-73809 HIGH
8.7 Aug 27

Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface e
CVE-2026-75814 HIGH
8.6 Aug 27

Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote att
CVE-2026-77977 HIGH
7.2 Aug 27

Unauthenticated reboot and factory-reset of Ebyte NE2-D11 gateways is possible from the adjacent network when default cr
CVE-2026-75548 MEDIUM
5.3 Aug 27

Clickjacking vulnerability in the Ebyte NE2-D11 industrial IoT device web management interface enables a remote unauthen

Same weakness CWE-522 – Insufficiently Protected Credentials

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2021-30116 CRITICAL POC
9.8
CVE-2024-44000 CRITICAL POC
9.8
CVE-2023-6421 HIGH POC
7.5
CVE-2017-8225 CRITICAL POC
9.8
CVE-2025-25570 CRITICAL POC
9.8
CVE-2017-17106 CRITICAL POC
9.8
CVE-2017-8837 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-73839 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy