Ebyte NE2-D11 EUVD-2026-67284

Exploitation requires that a legitimate administrator of the Ebyte NE2-D11 device have an active authenticated browser session to the device's web management interface at the time they visit the attacker-controlled page - the administrator's session cookie is automatically included by the browser in the forged request. The web management interface must be enabled and reachable from the administrator's browser (i.e., accessible from the network segment where the administrator's workstation resides). No special device configuration beyond the default web management interface being active is required. The attacker requires no credentials or direct network access to the device. Exploitation is limited by: (1) the need to successfully social-engineer a specific authenticated administrator, raising the bar above opportunistic exploitation; (2) the administrator's browser must be able to reach the device management interface (same network segment or routed path); and (3) the forged request cannot read response data due to the browser's same-origin policy, limiting confidentiality impact to what can be triggered by blind state-changing requests.

CVSS 4.0 scores this 8.6 (High) with AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, reflecting network reachability, low attack complexity, no attacker privileges required, and high impact on the vulnerable device. The key limiting factor is UI:A - active administrator interaction is required, preventing fully automated or mass exploitation and placing this firmly in the targeted social engineering threat category rather than opportunistic scanning. EPSS probability data was not provided in the available intelligence, leaving statistical exploitation likelihood unquantified. No CISA KEV listing and no public POC exploit has been identified, consistent with a newly disclosed ICS advisory without yet-observed mass exploitation. The ICS/OT context meaningfully elevates practical risk: configuration changes on industrial networking equipment can cascade into operational disruptions, and administrators of embedded OT devices may be higher-value social engineering targets than typical corporate IT staff. The CVSS 4.0 VC:H metric warrants scrutiny - classical CSRF is constrained by the browser's same-origin policy from reading responses, suggesting the confidentiality impact may be overstated relative to the integrity and availability impact, which are well-supported by the description.

An attacker researching the target organization identifies Ebyte NE2-D11 devices via industrial network scanning or public documentation, then crafts a webpage containing hidden HTML forms or JavaScript fetch calls targeting the device's management interface API endpoints. The attacker sends a spear-phishing email to a network administrator with a pretext link; when the administrator clicks while their browser session is authenticated to the device, the browser silently submits the forged request, changing the device's network configuration or triggering a reboot. No public POC exploit has been identified, but the attack class is well-understood and easily implemented against CSRF-unprotected targets.