EUVD-2026-67282
GHSA-rj7p-436q-6xv2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device management interface
-
DeliveryInspect client-side auth logic
-
ExploitReproduce and forge valid auth request
-
ExecutionBypass authentication
-
PersistObtain administrative access
-
ImpactReconfigure or disrupt gateway
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication Use of client-side authentication
|
| Exploitation Conditions | Exploitation requires only network access to the NE2-D11 web/management interface; per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) there is no authentication, no user interaction, and no special attack requirement. The one real limiting factor is reachability: the attacker must be able to route to the device's management interface, which in typical OT deployments sits on a segmented or air-gapped network rather than the public internet. There is no dependency on a non-default feature - the weakness is inherent to how the firmware performs authentication - so any reachable device running the affected firmware is exploitable. |
| Impact | All available signals point to genuine high priority for exposed devices. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) indicates remote, low-complexity, unauthenticated exploitation with high impact to confidentiality, integrity, and availability of the device itself (no subsequent-system scope change). The vulnerability is reported by ICS-CERT and documented in a CISA ICS advisory, which lends coordinator confidence to the finding. Tempering the raw score: no EPSS value, no KEV listing, and no POC were provided, so there is no evidence of active exploitation or mass scanning yet - practical risk is dominated by network exposure of these OT gateways, which are typically deployed on isolated or segmented industrial networks. The severity is real, but the realistic blast radius depends heavily on whether a given device is reachable from untrusted networks. |
| Exploit ScenarioDerived | An attacker with network reachability to the NE2-D11 management interface inspects the device's client-side login code, reproduces the authentication logic locally, and submits a self-generated valid authentication request. Without knowing any password, the attacker is granted administrative access and can reconfigure the gateway, alter serial/network routing, or disrupt the industrial process it bridges. No POC is publicly identified, but the low complexity makes independent reproduction straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 28, 2026
Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gain full administrative control by reproducing the device's client-side authentication logic. Because the login check runs in the client rather than being enforced server-side, an attacker can craft valid authentication requests without any credentials. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible and carries a CVSS 4.0 base score of 9.3.
Earlier versions of this analysis (1)
Authentication bypass in the Ebyte NE2-D11 device firmware allows unauthenticated remote attackers to obtain full administrative access by reproducing the device's client-side authentication logic and forging valid authentication requests. The flaw (CWE-603, Use of Client-Side Authentication) carries a CVSS 9.8 and was disclosed via a CISA ICS advisory (ICSA-26-237-06); no public exploit identified at time of analysis, though the trivial reproducibility of the client-side check makes weaponization straightforward.
RemediationAI
No vendor-released patch version is identified in the available data; consult the CISA ICS advisory ICSA-26-237-06 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06) for the vendor's fixed firmware release and apply it once confirmed. Because the authentication check is client-side and cannot be trusted, the most effective compensating control is network isolation: place the NE2-D11 on a segmented OT/management VLAN with no direct internet exposure and restrict access to the web management interface to a small set of trusted engineering workstations via firewall ACLs - the trade-off is that remote/off-site management becomes indirect and requires a jump host or VPN. Where feasible, block or filter inbound access to the device's HTTP/management port from untrusted networks and disable remote management if the device offers that option; this limits attack surface but may break legitimate remote monitoring workflows. Do not rely on the device's own login as a control, since the bypass defeats it entirely.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The NE2-D11 is an industrial networking device (serial device server / gateway) from Ebyte, tracked under CPE cpe:2.3:a:ebyte:ebyte_ne2-d11_firmware. The root cause is CWE-603 (Use of Client-Side Authentication): the firmware's web management interface performs the authentication decision in code that runs on the client (e.g. JavaScript in the browser) instead of validating credentials on the server. Any logic that a legitimate client executes to prove identity can be observed and replayed by an attacker, so the trust boundary is effectively absent. This class of flaw is common in embedded/OT web UIs designed for convenience or low resource use rather than a hardened server-side session model.
Know when Ebyte Ne2 D11 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Client-side auth bypass is remotely reachable and unauthenticated (AV:N/AC:L/PR:N/UI:N) and yields full admin control of the device, so C/I/A:H with no scope change.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device.
Executive ViewAI
The Ebyte NE2-D11 serial-to-Ethernet gateway contains a critical authentication bypass vulnerability (CVE-2026-71187, CVSS 9.3) allowing unauthenticated remote attackers to gain full administrative control of affected devices. Organizations using this gateway in industrial or operational environments face immediate risk of complete device compromise with no available patch, creating potential disruption to connected critical systems.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) strict network segmentation isolating the NE2-D11 to trusted management subnets only, (2) firewall policies blocking all inbound connections except from authorized administrative workstations, (3) continuous monitoring and alerting for any administrative access attempts, and (4) if operationally feasible, temporary air-gap isolation of non-critical devices pending vendor patch availability or planned replacement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Ebyte Ne2 D11 Firmware
View allAuthentication bypass in the Ebyte NE2-D11 firmware web management interface lets unauthenticated remote attackers reach
Authentication bypass in the Ebyte NE2-D11 network device's vendor configuration utility allows an unauthenticated attac
Authentication token theft and session impersonation affects the web management interface of Ebyte NE2-D11 industrial ga
Authentication weakness in Ebyte NE2-D11 firmware stems from use of a deprecated hashing algorithm in an authentication-
Cleartext transmission of MQTT credentials and control traffic in Ebyte NE2-D11 firmware allows network-positioned attac
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication sta
Unrestricted authentication attempts in Ebyte NE2-D11 firmware expose password-protected deployments to automated brute-
Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface e
Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote att
Unauthenticated reboot and factory-reset of Ebyte NE2-D11 gateways is possible from the adjacent network when default cr
Credential exposure in Ebyte NE2-D11 firmware allows an unauthenticated adjacent-network attacker to recover administrat
Exploit-DB