EUVD-2026-67283
GHSA-62mm-rmvp-f5p7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable replay needs no privileges (PR:N), but the attacker must first obtain a leaked token from exposed session data, making the attack conditional (AC:H); full device compromise gives C/I/A:H.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session information to obtain and reuse a valid token. Successful exploitation could allow an attacker to impersonate an authenticated user and gain unauthorized access to device management functionality.
AnalysisAI
Authentication token theft and session impersonation affects the web management interface of Ebyte NE2-D11 industrial gateway firmware, where session tokens are insufficiently protected during client-side handling (CWE-598). An attacker able to observe exposed session information can capture and replay a valid token to impersonate an authenticated operator and gain full control of device management functions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to first obtain a valid authentication token from exposed session information for the NE2-D11 web management interface - the description explicitly conditions the attack on 'access to exposed session information,' consistent with CWE-598 where the token leaks through URL query strings, browser history, HTTP Referer headers, or intermediary/proxy logs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No specific vendor-released fixed firmware version is identified in the provided data, so consult CISA ICSA-26-237-06 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06) and the linked CSAF file for the vendor's remediation and any patched firmware build, and apply the vendor-supplied firmware update once identified. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of all Ebyte NE2-D11 devices in your infrastructure, document firmware versions, and map network connectivity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ebyte Ne2 D11 Firmware
View allAuthentication bypass in the Ebyte NE2-D11 firmware web management interface lets unauthenticated remote attackers reach
Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gai
Cleartext transmission of MQTT credentials and control traffic in Ebyte NE2-D11 firmware allows network-positioned attac
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication sta
Unrestricted authentication attempts in Ebyte NE2-D11 firmware expose password-protected deployments to automated brute-
Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface e
Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote att
Unauthenticated reboot and factory-reset of Ebyte NE2-D11 gateways is possible from the adjacent network when default cr
Clickjacking vulnerability in the Ebyte NE2-D11 industrial IoT device web management interface enables a remote unauthen
Plaintext administrative credential exposure in the Ebyte NE2-D11 firmware management interface allows anyone with physi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today