Which versions of Ebyte NE2-D11 are affected by CVE-2026-75813?

The Ebyte NE2-D11 industrial wireless module contains a critical remote authorization bypass that allows any network-connected attacker to read and modify device configurations without credentials.

How to fix or mitigate CVE-2026-75813?

Within 24 hours, identify and catalog all Ebyte NE2-D11 modules in production OT networks and document their network accessibility. Immediately apply firewall rules or network segmentation to restrict access to affected devices. Within 7 days, establish communication with Ebyte support to confirm patch availability and timeline; in parallel, evaluate temporary operational mitigations such as isolated network operation or temporary device replacement for critical systems. Within 30 days, remain in contact with Ebyte for patch release and plan a controlled deployment once available; maintain network-level compensating controls until firmware is updated.

Ebyte NE2-D11 CVE-2026-75813

Q: What is the CVSS score of CVE-2026-75813?

CVE-2026-75813 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-67288 HIGH

Missing Authorization (CWE-862)

2026-08-27 icscert

GHSA-7mpm-96ch-vg98

Authentication Bypass Ebyte Ne2 D11 Firmware

8.7

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-exposed configuration endpoints require no authentication (PR:N, AV:N, AC:L); impact is integrity-only with no scope change, consistent with the CVSS 4.0 VI:H/VC:N/VA:N metrics.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 28, 2026 - 00:46 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 28, 2026 - 00:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 28, 2026 - 00:22 vuln.today

cvss_changed

CVSS changed

Aug 28, 2026 - 00:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Aug 27, 2026 - 23:57 vuln.today

CVE Published

Aug 27, 2026 - 21:33 cve.org

HIGH 7.5

DescriptionCVE.org

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality.

AnalysisAI

Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows any network-reachable attacker to read or overwrite sensitive device settings due to missing server-side authorization (CWE-862). The CVSS 4.0 vector (PR:N/AV:N/AC:L) confirms no credentials or special conditions are needed, and full device configuration compromise is possible. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The CVSS 4.0 vector (PR:N/AC:L/AT:N/UI:N) confirms no authentication is required, no special attack conditions apply, and no user interaction is needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 8.7 with VI:H reflects a meaningful integrity impact - an unauthenticated network attacker can overwrite device configuration entirely. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Consult the CISA ICS-CERT advisory ICSA-26-237-06 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06 and the CSAF file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json for vendor-issued firmware update guidance; no exact patched firmware version is confirmed from the available data. … Detailed patch versions, workarounds, and compensating controls in full report.