Ebyte NE2-D11 CVE-2026-75548

The target must be an authenticated administrator with an active browser session to the Ebyte NE2-D11 web management interface at the time of the attack. The attacker must successfully deliver a crafted webpage to that administrator and induce them to visit it - typically via phishing or a watering hole - while the authenticated session remains valid. The device's web management interface must be reachable from the administrator's browser, meaning it must be on a network segment accessible from the administrator's client machine. Exploitation is bounded by the requirement for simultaneous authenticated session and successful social engineering; automated or unauthenticated exploitation is not possible. No non-default device configuration is required - the vulnerability exists in the default state of the web management interface.

The CVSS 5.4 Medium score accurately reflects a conditionally exploitable but non-trivial attack. The network vector (AV:N) and low complexity (AC:L) indicate no special technical prerequisites for the attacker to prepare the malicious page, but the user-interaction requirement (UI:R) and unchanged scope (S:U) substantially constrain real-world risk: exploitation cannot proceed without social engineering success against an authenticated administrator. In OT and ICS environments - where management interfaces may be accessed from shared workstations lacking strict browser hygiene - the UI:R prerequisite is more plausible than in hardened enterprise settings. The limited impact ceiling (C:L/I:L/A:N) means even a successful attack yields configuration tampering rather than direct device compromise or data exfiltration. No EPSS score or KEV listing was provided in available data, and no public exploit has been identified, suggesting this has not seen opportunistic or automated exploitation. The CVSS vector is internally consistent with the description and presents no conflicting signals.

An attacker hosts a webpage that loads the Ebyte NE2-D11 management interface inside a transparent iframe positioned over visually appealing content, then delivers the link via a phishing email to a facility engineer known to manage the device. The engineer, who has an active authenticated session to the management UI, clicks what appears to be an innocuous button on the page and unknowingly submits a configuration change - such as altering network settings or triggering a device restart - to the NE2-D11. No public exploit code has been identified at time of analysis, though the underlying clickjacking technique is well-documented and requires no advanced tooling to implement.