Ebyte NE2-D11 EUVD-2026-67283

Exploitation requires the attacker to first obtain a valid authentication token from exposed session information for the NE2-D11 web management interface - the description explicitly conditions the attack on 'access to exposed session information,' consistent with CWE-598 where the token leaks through URL query strings, browser history, HTTP Referer headers, or intermediary/proxy logs. The device must be network-reachable by the attacker for token replay (AV:N), and no additional authentication or user interaction is needed once the token is held (PR:N/UI:N). The limiting factor is obtaining that leaked token: an attacker with no path to observe the session material (e.g., a properly segmented, HTTPS-only deployment with no token logging) cannot mount the attack, which constrains real-world exploitation below what the raw 9.3 score implies.

The signals are mixed. The vendor/CISA CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.3 CRITICAL and models the attack as network-reachable, low-complexity, and requiring no privileges or user interaction. However, the description qualifies exploitation as requiring 'access to exposed session information,' which is a real precondition the base vector's AC:L/PR:N does not fully capture - the attacker must first obtain a leaked token (via logs, referer, shared network path, or proxy) rather than exploiting a wholly unauthenticated remote entry point. There is no CISA KEV listing and no POC referenced, so this is not confirmed active exploitation; EPSS was not provided. Realistically this is a high-priority patch for exposed OT/ICS gateways given the total-compromise impact and network vector, but the practical attack depends on the token actually being exposed somewhere the attacker can reach - verify the specific leakage path with the vendor advisory.

An attacker with visibility into an NE2-D11 administrator's session information - for instance by reading a token that appears in a URL captured in proxy logs, browser history, or a shared/monitored network segment - copies the valid authentication token and replays it against the device's web management interface. Because the gateway trusts the token alone, the attacker is granted an authenticated session and can reconfigure the device, alter serial-to-network bridging, or disrupt the connected OT process. No public POC is referenced, and the attack hinges on first obtaining the exposed token.