Ebyte NE2-D11 CVE-2026-76945

No special configuration is required beyond the device being network-reachable - the flaw is in the core authentication design of the firmware, not a specific optional feature. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote unauthenticated exploitation against default firmware behavior on any reachable NE2-D11 device. Exploitation is limited by network reachability: devices on isolated OT segments or behind strict firewall rules that block access to management ports are not directly reachable by external attackers. The attack requires capturing or constructing a valid-looking token, which in the case of replay requires prior passive access to observe a legitimate session; manipulation (without a captured token) depends on the token format being predictable or unsigned, which the CWE-603 classification implies. Authentication requirements are not confirmed beyond what the CVSS PR:N vector indicates.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a highly accessible attack: no privileges, no user interaction, low complexity, fully network-reachable. The confidentiality impact is rated High (VC:H), but integrity and availability impacts are scored None (VI:N/VA:N) - which is worth scrutinizing, since unauthorized administrative access typically permits configuration changes. This discrepancy should be verified against the vendor advisory. No EPSS data was provided, and the vulnerability is not in CISA KEV, suggesting no confirmed widespread exploitation at time of analysis. No public POC has been identified. Despite the high CVSS, real-world exposure is bounded by the device's OT deployment context: NE2-D11 units in properly segmented industrial networks may not be directly reachable from untrusted networks. For internet-exposed or flat-network OT deployments, risk is elevated. The absence of any patch version in the provided data is a meaningful gap - defenders cannot confirm a fixed firmware release.

An attacker on the same network segment as an Ebyte NE2-D11 device captures an authentication token from a legitimate administrative session using passive network interception. The attacker replays the captured token in a new HTTP or protocol request to the device, which accepts it without checking session binding or expiry, granting full administrative access. From this position, the attacker can read device configuration, potentially exposing credentials or network topology used in the broader OT environment.