Ebyte NE2-D11 EUVD-2026-67295

Two simultaneous conditions must be present: (1) the Ebyte NE2-D11 must be running with factory default credentials still configured - devices where credentials have been updated are not vulnerable as described; and (2) the attacker must have Layer-2 adjacent network access (AV:A per the CVSS 4.0 vector), meaning internet-based exploitation is not possible. The specific vulnerable operations are device reboot and factory settings restoration via the vendor configuration utility. Authentication is not required (PR:N) when the default-credential precondition is met. Exploitation is bounded by the adjacency requirement (limiting attackers to local network presence), the default-credentials precondition (hardened deployments are unaffected), the impact scope being restricted to the NE2-D11 itself (no lateral system compromise), and no confidentiality exposure. No user interaction is required once network access is obtained.

The CVSS 4.0 score of 7.2 with vector AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H reflects high integrity and availability impact against the device itself, with no confidentiality exposure. The adjacency requirement (AV:A) substantially constrains the attacker pool to those with Layer-2 or equivalent local network access, eliminating internet-facing risk. The critical enabling condition - default credentials remaining in place - is operationally common in OT environments where devices are provisioned without credential-hardening procedures. No CISA KEV listing and no POC are available, meaning no public exploit identified at time of analysis; EPSS data was not provided. In ICS/OT contexts, the availability and integrity impacts are disproportionately severe relative to the CVSS base score: a factory reset of a gateway can disrupt communications across downstream OT assets, cause process visibility loss, and require on-site remediation. The risk is elevated for organizations with flat OT networks and poor credential hygiene, but effectively nil for those with proper segmentation and default-credential elimination programs.

An attacker who has gained a foothold on the same network segment as the Ebyte NE2-D11 - through a compromised engineering workstation, rogue device, or inadequate OT network segmentation - sends a crafted unauthenticated request to the device's configuration utility targeting the factory reset function. Because default credentials are still in place and no authentication is enforced on the reset endpoint, the device erases its running configuration and restarts, taking associated downstream OT communications offline until an operator can physically reconfigure the gateway. No exploit tooling is required beyond knowledge of the configuration utility's request format.