Ebyte NE2-D11 EUVD-2026-67290

Exploitation requires the attacker to be positioned to observe the device's MQTT traffic - the same Layer-2 segment, a mirrored/tapped link, or a man-in-the-middle position on the path to the broker - because the weakness is passive cleartext exposure of an unencrypted MQTT session (broker traffic, typically port 1883). No authentication, user interaction, or special product configuration is needed on the victim side; the vulnerable behavior is present whenever MQTT-over-TLS is not in use, which the advisory indicates is the affected condition. What LIMITS exploitation is precisely that network-path requirement: on a segmented, VPN-tunneled, or otherwise encrypted deployment the traffic cannot be trivially intercepted, so realistic risk is highest on flat or internet-exposed networks and lowest on isolated OT segments.

Signals are mixed in a way worth stating plainly. The vendor/NVD CVSS 4.0 base of 9.3 (AV:N/AC:L/PR:N/UI:N with VC:H/VI:H/VA:H) treats this as remotely and trivially exploitable, but a cleartext-interception weakness realistically requires the attacker to already hold a position on the traffic path - a shared network segment, a compromised upstream hop, or a man-in-the-middle foothold - which is closer to adjacent access than truly remote-from-anywhere; verify network exposure against the actual deployment topology. There is no CISA KEV listing and no POC referenced, and no EPSS score was supplied, so the high base score reflects potential impact rather than confirmed widespread exploitation. Because this is an OT/ICS gateway, the impact if intercepted is genuinely serious (credential theft, device impersonation, and disruption of messaging), so operators exposing these devices across untrusted or flat networks should treat it as a priority even though it is not yet known to be exploited in the wild; on isolated, encrypted, or segmented networks the practical risk drops substantially.

An attacker who gains a foothold on the same network segment as the NE2-D11 - for example a compromised host on a flat OT network or an untrusted upstream link - passively captures the plaintext MQTT session and reads the device credentials and control messages. Using the stolen credentials, the attacker reconnects to the broker as the device, publishes forged commands to impersonate it, and disrupts legitimate messaging. No public exploit code is required beyond a standard packet sniffer such as Wireshark.