Ebyte NE2-D11 EUVD-2026-67288

The CVSS 4.0 vector (PR:N/AC:L/AT:N/UI:N) confirms no authentication is required, no special attack conditions apply, and no user interaction is needed. The sole prerequisite is network reachability to the NE2-D11 device's configuration endpoints. Exploitation is limited by network segmentation: if the device is isolated on an OT-only network segment with no access from untrusted hosts, remote exploitation from corporate IT networks or the internet is prevented. No special firmware feature, non-default configuration, or specific device state is required - the vulnerability is present in the device's default operational mode.

The CVSS 4.0 score of 8.7 with VI:H reflects a meaningful integrity impact - an unauthenticated network attacker can overwrite device configuration entirely. The vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates exploitation is straightforward with no preconditions beyond network reachability, making the technical barrier very low. No EPSS probability data was provided, so quantified exploitation likelihood cannot be stated. KEV status is absent, indicating no CISA-confirmed active exploitation; however, ICS-CERT involvement elevates operational concern because NE2-D11 modules deployed in industrial environments may control physical processes where unauthorized configuration changes could have operational consequences. The wildcard CPE scope means no firmware version is exempt, complicating remediation at scale in OT contexts where devices often run unmanaged for long periods. The primary limiting factor is network segmentation: devices isolated on OT-only segments inaccessible from untrusted hosts are effectively protected without patching.

An attacker with network access to the NE2-D11 - such as a threat actor who has pivoted into an OT network segment or an insider on the same LAN - sends standard unauthenticated HTTP requests to the device's configuration API endpoints. Without any credential or exploit payload requirement, the attacker reads current device settings (potentially including credentials or network topology data) and then overwrites parameters such as serial communication settings, network addresses, or access controls. This manipulation could disrupt the device's industrial bridging role or serve as a foothold to further pivot within the OT environment.