Ebyte NE2-D11 CVE-2026-73839

Physical proximity to the Ebyte NE2-D11 device is required, confirmed by the CVSS AV:P (Physical) metric. The attacker must be able to view the device's management interface - either a local console, web UI accessible from the device's wired/wireless interface at close range, or any attached display. No authentication, exploitation tools, or special technical knowledge is required; the credentials are passively visible to anyone who can see the screen. Exploitation is limited by: (1) mandatory physical proximity to the target device, ruling out remote or internet-based attacks entirely; (2) OT/ICS deployment contexts where physical access is typically restricted to authorized personnel; and (3) the requirement that the management interface must be in a state where credentials are displayed. No non-default configuration is needed to trigger the exposure - the plaintext display appears to be a default behavior of the firmware management interface.

The CVSS 4.6 base score with AV:P (Physical) accurately reflects a constrained but real threat. Physical access is the primary limiting factor, which substantially narrows the realistic attacker pool to insiders, facility visitors, maintenance personnel, or adversaries with site access. The C:H (High confidentiality) impact is significant - full administrative credentials are exposed, not merely partial information. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified statistically. The vulnerability is not listed in CISA KEV and no POC has been identified, indicating no confirmed active exploitation. However, ICS-CERT reporting origin is notable: OT environments often lack robust physical access controls across all device locations (factory floors, remote substations, utility closets), making the physical attack vector less restrictive in practice than in office IT environments. The CPE wildcard suggests all deployed firmware versions are affected with no safe version to fall back to without a vendor patch.

A maintenance contractor or insider threat with legitimate site access approaches an Ebyte NE2-D11 device on a factory floor and opens the management interface on the device's local console or web UI. The administrative credentials are displayed in plaintext on screen, requiring no tools, exploits, or special knowledge to read - a photograph or simple observation suffices. The attacker subsequently uses these credentials to log in remotely or locally, reconfigure the device, and disrupt or surveil the connected industrial process.