EUVD-2026-67284
GHSA-rrpm-rq88-pwc9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CSRF cannot read responses via SOP, so C:L; admin interaction is required (UI:R); integrity and availability fully compromised via forged config requests.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of device availability.
AnalysisAI
Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote attacker to trigger unauthorized configuration changes or disrupt device availability on ICS/OT networking hardware. The attack requires social engineering an authenticated administrator into visiting a malicious webpage, at which point the administrator's browser silently submits forged requests to the management interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a legitimate administrator of the Ebyte NE2-D11 device have an active authenticated browser session to the device's web management interface at the time they visit the attacker-controlled page - the administrator's session cookie is automatically included by the browser in the forged request. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 4.0 scores this 8.6 (High) with AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, reflecting network reachability, low attack complexity, no attacker privileges required, and high impact on the vulnerable device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the CISA ICS advisory ICSA-26-237-06 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06) and the CSAF document at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json for any vendor-released firmware update - no specific patched version was confirmed in the available intelligence and Ebyte should be contacted directly for patch availability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and inventory all Ebyte NE2-D11 devices in your network and restrict web management interface access to administrative VPN connections only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ebyte Ne2 D11 Firmware
View allAuthentication bypass in the Ebyte NE2-D11 firmware web management interface lets unauthenticated remote attackers reach
Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gai
Authentication token theft and session impersonation affects the web management interface of Ebyte NE2-D11 industrial ga
Cleartext transmission of MQTT credentials and control traffic in Ebyte NE2-D11 firmware allows network-positioned attac
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication sta
Unrestricted authentication attempts in Ebyte NE2-D11 firmware expose password-protected deployments to automated brute-
Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface e
Unauthenticated reboot and factory-reset of Ebyte NE2-D11 gateways is possible from the adjacent network when default cr
Clickjacking vulnerability in the Ebyte NE2-D11 industrial IoT device web management interface enables a remote unauthen
Plaintext administrative credential exposure in the Ebyte NE2-D11 firmware management interface allows anyone with physi
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today