Ebyte
Monthly
Missing authorization controls in the Ebyte NA111-M industrial wireless module firmware allow a low-privileged authenticated user to access and modify administrative configuration functions that should be restricted to privileged accounts. The device fails to enforce privilege separation between limited-user and administrator roles, meaning any authenticated operator-level account can alter security-sensitive settings and affect device confidentiality, integrity, and availability. The attack is network-accessible with no user interaction required (CVSS 4.0: 8.7), posing a practical risk in OT/ICS environments; no public exploit has been identified at time of analysis.
Authentication weakness in Ebyte NE2-D11 firmware stems from use of a deprecated hashing algorithm in an authentication-related operation, letting an attacker who can observe, manipulate, or predict the authentication exchange defeat the login mechanism and gain unauthorized access to the industrial serial-to-Ethernet device. The flaw was reported through CISA ICS-CERT (advisory ICSA-26-237-06) and carries a CVSS 4.0 base score of 9.3, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Compromise of these edge/OT gateway devices can expose the serial equipment behind them, so despite the niche footprint the impact per device is high.
Authentication bypass in the Ebyte NE2-D11 network device's vendor configuration utility allows an unauthenticated attacker on the adjacent network to reach administrative functions without proving the operator's identity. Under certain credential conditions the attacker can alter critical device settings or change access credentials, locking legitimate administrators out of their own OT/ICS equipment. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the CISA ICS advisory (ICSA-26-237-06) confirms the weakness.
Credential exposure in Ebyte NE2-D11 firmware allows an unauthenticated adjacent-network attacker to recover administrative credentials from exported configuration files. The device exports sensitive configuration data - including credentials - without adequate protection (CWE-312: Cleartext Storage of Sensitive Information), meaning any attacker positioned on the local network who can access or intercept an exported configuration file gains valid credentials. Compromised credentials enable direct device access and, where the same credentials are reused, lateral movement to similarly configured Ebyte deployments. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated reboot and factory-reset of Ebyte NE2-D11 gateways is possible from the adjacent network when default credentials have not been changed. The vendor configuration utility (CWE-306) enforces no authentication gate on high-impact administrative actions under that condition, allowing an attacker with LAN access to erase device configuration and cause sustained service outages. Reported by ICS-CERT via advisory ICSA-26-237-06; no public exploit identified at time of analysis and no active exploitation confirmed.
Cleartext transmission of MQTT credentials and control traffic in Ebyte NE2-D11 firmware allows network-positioned attackers to intercept authentication material and message payloads, then impersonate devices and disrupt messaging. The flaw affects the NE2-D11 serial-to-Ethernet/MQTT gateway and was disclosed via CISA ICS advisory ICSA-26-237-06 (reported by ICS-CERT). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication state entirely to the client, performing no meaningful server-side token validation. An unauthenticated remote attacker can replay or forge authentication tokens to elevate access to administrative functionality without valid credentials. Reported via ICS-CERT advisory ICSA-26-237-06, this is an OT/ICS device vulnerability with no public exploit identified at time of analysis and no KEV listing.
Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows any network-reachable attacker to read or overwrite sensitive device settings due to missing server-side authorization (CWE-862). The CVSS 4.0 vector (PR:N/AV:N/AC:L) confirms no credentials or special conditions are needed, and full device configuration compromise is possible. Reported via CISA ICS-CERT advisory ICSA-26-237-06; no public exploit code or active KEV-listed exploitation is confirmed at time of analysis.
Unrestricted authentication attempts in Ebyte NE2-D11 firmware expose password-protected deployments to automated brute-force credential attacks. The device, classified as an industrial OT product and covered by ICS-CERT advisory ICSA-26-237-06, lacks both rate limiting and account lockout controls - two standard defenses against credential guessing. A remote unauthenticated attacker who successfully brute-forces the login interface gains high-confidence read access to device configuration and data, reflected in the CVSS 4.0 VC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote attacker to trigger unauthorized configuration changes or disrupt device availability on ICS/OT networking hardware. The attack requires social engineering an authenticated administrator into visiting a malicious webpage, at which point the administrator's browser silently submits forged requests to the management interface. Reported by ICS-CERT under advisory ICSA-26-237-06, all known firmware versions are affected with no confirmed patched release identified at time of analysis, and no public exploit or CISA KEV listing has been observed.
Authentication token theft and session impersonation affects the web management interface of Ebyte NE2-D11 industrial gateway firmware, where session tokens are insufficiently protected during client-side handling (CWE-598). An attacker able to observe exposed session information can capture and replay a valid token to impersonate an authenticated operator and gain full control of device management functions. The flaw carries a CVSS 4.0 score of 9.3 and was disclosed via CISA ICS-CERT (ICSA-26-237-06); no public exploit has been identified at time of analysis.
Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gain full administrative control by reproducing the device's client-side authentication logic. Because the login check runs in the client rather than being enforced server-side, an attacker can craft valid authentication requests without any credentials. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible and carries a CVSS 4.0 base score of 9.3.
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface exposes credentials to any attacker capable of intercepting network traffic between a user and the device. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects that no authentication is required on the attacker side - only network traffic access is needed to harvest management credentials, which then enable full unauthorized access to device management functionality. Reported by CISA ICS-CERT under advisory ICSA-26-237-06, this vulnerability affects OT/industrial gateway hardware where flat network topologies are common, elevating realistic exploitation risk beyond typical enterprise environments. No public exploit identified at time of analysis and no CISA KEV listing.
Authentication bypass in the Ebyte NE2-D11 firmware web management interface lets unauthenticated remote attackers reach administrative functions that should be gated behind login. The interface fails to consistently enforce authentication, exposing sensitive device configuration for reading, tampering, and denial of service. No public exploit identified at time of analysis, but the flaw is trivially reachable over the network and was disclosed via a CISA ICS advisory (ICSA-26-237-06).
Clickjacking vulnerability in the Ebyte NE2-D11 industrial IoT device web management interface enables a remote unauthenticated attacker to embed the administrative UI within a crafted external webpage. By luring an authenticated administrator to visit the malicious page, an attacker can trick that administrator into submitting unintended configuration changes or triggering disruptive actions against the device. Reported by CISA ICS-CERT under advisory ICSA-26-237-06; no public exploit identified at time of analysis.
Plaintext administrative credential exposure in the Ebyte NE2-D11 firmware management interface allows anyone with physical access to directly observe device credentials without any authentication or tooling. Reported by ICS-CERT under advisory ICSA-26-237-06, the flaw (CWE-522) affects all known firmware versions per CPE data, with a physical attack vector (AV:P) confirming that exploitation requires proximity to the device. Credential capture could enable full administrative control over the device, with downstream risk to industrial operations where the NE2-D11 is deployed. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Missing authorization controls in the Ebyte NA111-M industrial wireless module firmware allow a low-privileged authenticated user to access and modify administrative configuration functions that should be restricted to privileged accounts. The device fails to enforce privilege separation between limited-user and administrator roles, meaning any authenticated operator-level account can alter security-sensitive settings and affect device confidentiality, integrity, and availability. The attack is network-accessible with no user interaction required (CVSS 4.0: 8.7), posing a practical risk in OT/ICS environments; no public exploit has been identified at time of analysis.
Authentication weakness in Ebyte NE2-D11 firmware stems from use of a deprecated hashing algorithm in an authentication-related operation, letting an attacker who can observe, manipulate, or predict the authentication exchange defeat the login mechanism and gain unauthorized access to the industrial serial-to-Ethernet device. The flaw was reported through CISA ICS-CERT (advisory ICSA-26-237-06) and carries a CVSS 4.0 base score of 9.3, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Compromise of these edge/OT gateway devices can expose the serial equipment behind them, so despite the niche footprint the impact per device is high.
Authentication bypass in the Ebyte NE2-D11 network device's vendor configuration utility allows an unauthenticated attacker on the adjacent network to reach administrative functions without proving the operator's identity. Under certain credential conditions the attacker can alter critical device settings or change access credentials, locking legitimate administrators out of their own OT/ICS equipment. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the CISA ICS advisory (ICSA-26-237-06) confirms the weakness.
Credential exposure in Ebyte NE2-D11 firmware allows an unauthenticated adjacent-network attacker to recover administrative credentials from exported configuration files. The device exports sensitive configuration data - including credentials - without adequate protection (CWE-312: Cleartext Storage of Sensitive Information), meaning any attacker positioned on the local network who can access or intercept an exported configuration file gains valid credentials. Compromised credentials enable direct device access and, where the same credentials are reused, lateral movement to similarly configured Ebyte deployments. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated reboot and factory-reset of Ebyte NE2-D11 gateways is possible from the adjacent network when default credentials have not been changed. The vendor configuration utility (CWE-306) enforces no authentication gate on high-impact administrative actions under that condition, allowing an attacker with LAN access to erase device configuration and cause sustained service outages. Reported by ICS-CERT via advisory ICSA-26-237-06; no public exploit identified at time of analysis and no active exploitation confirmed.
Cleartext transmission of MQTT credentials and control traffic in Ebyte NE2-D11 firmware allows network-positioned attackers to intercept authentication material and message payloads, then impersonate devices and disrupt messaging. The flaw affects the NE2-D11 serial-to-Ethernet/MQTT gateway and was disclosed via CISA ICS advisory ICSA-26-237-06 (reported by ICS-CERT). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication state entirely to the client, performing no meaningful server-side token validation. An unauthenticated remote attacker can replay or forge authentication tokens to elevate access to administrative functionality without valid credentials. Reported via ICS-CERT advisory ICSA-26-237-06, this is an OT/ICS device vulnerability with no public exploit identified at time of analysis and no KEV listing.
Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows any network-reachable attacker to read or overwrite sensitive device settings due to missing server-side authorization (CWE-862). The CVSS 4.0 vector (PR:N/AV:N/AC:L) confirms no credentials or special conditions are needed, and full device configuration compromise is possible. Reported via CISA ICS-CERT advisory ICSA-26-237-06; no public exploit code or active KEV-listed exploitation is confirmed at time of analysis.
Unrestricted authentication attempts in Ebyte NE2-D11 firmware expose password-protected deployments to automated brute-force credential attacks. The device, classified as an industrial OT product and covered by ICS-CERT advisory ICSA-26-237-06, lacks both rate limiting and account lockout controls - two standard defenses against credential guessing. A remote unauthenticated attacker who successfully brute-forces the login interface gains high-confidence read access to device configuration and data, reflected in the CVSS 4.0 VC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote attacker to trigger unauthorized configuration changes or disrupt device availability on ICS/OT networking hardware. The attack requires social engineering an authenticated administrator into visiting a malicious webpage, at which point the administrator's browser silently submits forged requests to the management interface. Reported by ICS-CERT under advisory ICSA-26-237-06, all known firmware versions are affected with no confirmed patched release identified at time of analysis, and no public exploit or CISA KEV listing has been observed.
Authentication token theft and session impersonation affects the web management interface of Ebyte NE2-D11 industrial gateway firmware, where session tokens are insufficiently protected during client-side handling (CWE-598). An attacker able to observe exposed session information can capture and replay a valid token to impersonate an authenticated operator and gain full control of device management functions. The flaw carries a CVSS 4.0 score of 9.3 and was disclosed via CISA ICS-CERT (ICSA-26-237-06); no public exploit has been identified at time of analysis.
Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gain full administrative control by reproducing the device's client-side authentication logic. Because the login check runs in the client rather than being enforced server-side, an attacker can craft valid authentication requests without any credentials. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible and carries a CVSS 4.0 base score of 9.3.
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface exposes credentials to any attacker capable of intercepting network traffic between a user and the device. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects that no authentication is required on the attacker side - only network traffic access is needed to harvest management credentials, which then enable full unauthorized access to device management functionality. Reported by CISA ICS-CERT under advisory ICSA-26-237-06, this vulnerability affects OT/industrial gateway hardware where flat network topologies are common, elevating realistic exploitation risk beyond typical enterprise environments. No public exploit identified at time of analysis and no CISA KEV listing.
Authentication bypass in the Ebyte NE2-D11 firmware web management interface lets unauthenticated remote attackers reach administrative functions that should be gated behind login. The interface fails to consistently enforce authentication, exposing sensitive device configuration for reading, tampering, and denial of service. No public exploit identified at time of analysis, but the flaw is trivially reachable over the network and was disclosed via a CISA ICS advisory (ICSA-26-237-06).
Clickjacking vulnerability in the Ebyte NE2-D11 industrial IoT device web management interface enables a remote unauthenticated attacker to embed the administrative UI within a crafted external webpage. By luring an authenticated administrator to visit the malicious page, an attacker can trick that administrator into submitting unintended configuration changes or triggering disruptive actions against the device. Reported by CISA ICS-CERT under advisory ICSA-26-237-06; no public exploit identified at time of analysis.
Plaintext administrative credential exposure in the Ebyte NE2-D11 firmware management interface allows anyone with physical access to directly observe device credentials without any authentication or tooling. Reported by ICS-CERT under advisory ICSA-26-237-06, the flaw (CWE-522) affects all known firmware versions per CPE data, with a physical attack vector (AV:P) confirming that exploitation requires proximity to the device. Credential capture could enable full administrative control over the device, with downstream risk to industrial operations where the NE2-D11 is deployed. No public exploit has been identified and the vulnerability is not listed in CISA KEV.