Ebyte NE2-D11 CVE-2026-76133

Exploitation requires the attacker to be able to manipulate or predict the device's authentication exchange with the NE2-D11 - i.e. a network position to observe/tamper with the auth handshake or an ability to force predictable inputs into it - because the weakness is the deprecated hash used in that specific authentication operation. The CVSS 4.0 vector (AV:N/PR:N/UI:N) indicates network reach with no prior credentials or user interaction, but the description's 'under conditions where an attacker can manipulate or predict the authentication exchange' is a real limiting factor: an attacker isolated from the authentication traffic and unable to influence it cannot leverage the weak hash. Realistic risk is therefore highest where the device's management/auth interface is reachable on an untrusted or shared network segment; it is materially reduced when the device sits on an isolated management VLAN or behind a VPN. All firmware versions are currently listed as affected.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) scores 9.3 and models a network, low-complexity, unauthenticated attack with full confidentiality/integrity/availability impact on the device - a critical rating. However, the description qualifies exploitation as occurring 'under conditions where an attacker can manipulate or predict the authentication exchange,' which implies a real attack requirement (a position to observe/tamper with the exchange or an ability to force predictable inputs) that the AC:L/AT:N metrics arguably understate; this is a conflict worth verifying with the vendor. There is no EPSS score provided, the CVE is not in CISA KEV, and no POC is referenced, so this is a high-severity-by-CVSS finding without evidence of active or automated exploitation. Reported by CISA ICS-CERT, which lends credibility to the technical finding even though real-world exploitation signals are absent. Net: treat as a genuine high-priority patch item for anyone operating these gateways in OT environments, but the practical exploitability likely depends on network position and configuration rather than trivial internet-wide attack.

An attacker with a network path to an exposed NE2-D11 (for example on a flat OT network or an internet-reachable gateway) observes or forces the device's authentication exchange and exploits the deprecated hash to forge or replay a valid authentication response, bypassing login. Having authenticated, the attacker takes control of the converter and the serial field equipment bridged behind it. No public POC is referenced, and success depends on the attacker being able to manipulate or predict the authentication exchange.