Ebyte Ne2 D11 Firmware
Monthly
Unauthenticated reboot and factory-reset of Ebyte NE2-D11 gateways is possible from the adjacent network when default credentials have not been changed. The vendor configuration utility (CWE-306) enforces no authentication gate on high-impact administrative actions under that condition, allowing an attacker with LAN access to erase device configuration and cause sustained service outages. Reported by ICS-CERT via advisory ICSA-26-237-06; no public exploit identified at time of analysis and no active exploitation confirmed.
Cleartext transmission of MQTT credentials and control traffic in Ebyte NE2-D11 firmware allows network-positioned attackers to intercept authentication material and message payloads, then impersonate devices and disrupt messaging. The flaw affects the NE2-D11 serial-to-Ethernet/MQTT gateway and was disclosed via CISA ICS advisory ICSA-26-237-06 (reported by ICS-CERT). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication state entirely to the client, performing no meaningful server-side token validation. An unauthenticated remote attacker can replay or forge authentication tokens to elevate access to administrative functionality without valid credentials. Reported via ICS-CERT advisory ICSA-26-237-06, this is an OT/ICS device vulnerability with no public exploit identified at time of analysis and no KEV listing.
Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows any network-reachable attacker to read or overwrite sensitive device settings due to missing server-side authorization (CWE-862). The CVSS 4.0 vector (PR:N/AV:N/AC:L) confirms no credentials or special conditions are needed, and full device configuration compromise is possible. Reported via CISA ICS-CERT advisory ICSA-26-237-06; no public exploit code or active KEV-listed exploitation is confirmed at time of analysis.
Clickjacking vulnerability in the Ebyte NE2-D11 industrial IoT device web management interface enables a remote unauthenticated attacker to embed the administrative UI within a crafted external webpage. By luring an authenticated administrator to visit the malicious page, an attacker can trick that administrator into submitting unintended configuration changes or triggering disruptive actions against the device. Reported by CISA ICS-CERT under advisory ICSA-26-237-06; no public exploit identified at time of analysis.
Unrestricted authentication attempts in Ebyte NE2-D11 firmware expose password-protected deployments to automated brute-force credential attacks. The device, classified as an industrial OT product and covered by ICS-CERT advisory ICSA-26-237-06, lacks both rate limiting and account lockout controls - two standard defenses against credential guessing. A remote unauthenticated attacker who successfully brute-forces the login interface gains high-confidence read access to device configuration and data, reflected in the CVSS 4.0 VC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote attacker to trigger unauthorized configuration changes or disrupt device availability on ICS/OT networking hardware. The attack requires social engineering an authenticated administrator into visiting a malicious webpage, at which point the administrator's browser silently submits forged requests to the management interface. Reported by ICS-CERT under advisory ICSA-26-237-06, all known firmware versions are affected with no confirmed patched release identified at time of analysis, and no public exploit or CISA KEV listing has been observed.
Authentication token theft and session impersonation affects the web management interface of Ebyte NE2-D11 industrial gateway firmware, where session tokens are insufficiently protected during client-side handling (CWE-598). An attacker able to observe exposed session information can capture and replay a valid token to impersonate an authenticated operator and gain full control of device management functions. The flaw carries a CVSS 4.0 score of 9.3 and was disclosed via CISA ICS-CERT (ICSA-26-237-06); no public exploit has been identified at time of analysis.
Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gain full administrative control by reproducing the device's client-side authentication logic. Because the login check runs in the client rather than being enforced server-side, an attacker can craft valid authentication requests without any credentials. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible and carries a CVSS 4.0 base score of 9.3.
Plaintext administrative credential exposure in the Ebyte NE2-D11 firmware management interface allows anyone with physical access to directly observe device credentials without any authentication or tooling. Reported by ICS-CERT under advisory ICSA-26-237-06, the flaw (CWE-522) affects all known firmware versions per CPE data, with a physical attack vector (AV:P) confirming that exploitation requires proximity to the device. Credential capture could enable full administrative control over the device, with downstream risk to industrial operations where the NE2-D11 is deployed. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface exposes credentials to any attacker capable of intercepting network traffic between a user and the device. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects that no authentication is required on the attacker side - only network traffic access is needed to harvest management credentials, which then enable full unauthorized access to device management functionality. Reported by CISA ICS-CERT under advisory ICSA-26-237-06, this vulnerability affects OT/industrial gateway hardware where flat network topologies are common, elevating realistic exploitation risk beyond typical enterprise environments. No public exploit identified at time of analysis and no CISA KEV listing.
Authentication bypass in the Ebyte NE2-D11 firmware web management interface lets unauthenticated remote attackers reach administrative functions that should be gated behind login. The interface fails to consistently enforce authentication, exposing sensitive device configuration for reading, tampering, and denial of service. No public exploit identified at time of analysis, but the flaw is trivially reachable over the network and was disclosed via a CISA ICS advisory (ICSA-26-237-06).
Unauthenticated reboot and factory-reset of Ebyte NE2-D11 gateways is possible from the adjacent network when default credentials have not been changed. The vendor configuration utility (CWE-306) enforces no authentication gate on high-impact administrative actions under that condition, allowing an attacker with LAN access to erase device configuration and cause sustained service outages. Reported by ICS-CERT via advisory ICSA-26-237-06; no public exploit identified at time of analysis and no active exploitation confirmed.
Cleartext transmission of MQTT credentials and control traffic in Ebyte NE2-D11 firmware allows network-positioned attackers to intercept authentication material and message payloads, then impersonate devices and disrupt messaging. The flaw affects the NE2-D11 serial-to-Ethernet/MQTT gateway and was disclosed via CISA ICS advisory ICSA-26-237-06 (reported by ICS-CERT). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication state entirely to the client, performing no meaningful server-side token validation. An unauthenticated remote attacker can replay or forge authentication tokens to elevate access to administrative functionality without valid credentials. Reported via ICS-CERT advisory ICSA-26-237-06, this is an OT/ICS device vulnerability with no public exploit identified at time of analysis and no KEV listing.
Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows any network-reachable attacker to read or overwrite sensitive device settings due to missing server-side authorization (CWE-862). The CVSS 4.0 vector (PR:N/AV:N/AC:L) confirms no credentials or special conditions are needed, and full device configuration compromise is possible. Reported via CISA ICS-CERT advisory ICSA-26-237-06; no public exploit code or active KEV-listed exploitation is confirmed at time of analysis.
Clickjacking vulnerability in the Ebyte NE2-D11 industrial IoT device web management interface enables a remote unauthenticated attacker to embed the administrative UI within a crafted external webpage. By luring an authenticated administrator to visit the malicious page, an attacker can trick that administrator into submitting unintended configuration changes or triggering disruptive actions against the device. Reported by CISA ICS-CERT under advisory ICSA-26-237-06; no public exploit identified at time of analysis.
Unrestricted authentication attempts in Ebyte NE2-D11 firmware expose password-protected deployments to automated brute-force credential attacks. The device, classified as an industrial OT product and covered by ICS-CERT advisory ICSA-26-237-06, lacks both rate limiting and account lockout controls - two standard defenses against credential guessing. A remote unauthenticated attacker who successfully brute-forces the login interface gains high-confidence read access to device configuration and data, reflected in the CVSS 4.0 VC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote attacker to trigger unauthorized configuration changes or disrupt device availability on ICS/OT networking hardware. The attack requires social engineering an authenticated administrator into visiting a malicious webpage, at which point the administrator's browser silently submits forged requests to the management interface. Reported by ICS-CERT under advisory ICSA-26-237-06, all known firmware versions are affected with no confirmed patched release identified at time of analysis, and no public exploit or CISA KEV listing has been observed.
Authentication token theft and session impersonation affects the web management interface of Ebyte NE2-D11 industrial gateway firmware, where session tokens are insufficiently protected during client-side handling (CWE-598). An attacker able to observe exposed session information can capture and replay a valid token to impersonate an authenticated operator and gain full control of device management functions. The flaw carries a CVSS 4.0 score of 9.3 and was disclosed via CISA ICS-CERT (ICSA-26-237-06); no public exploit has been identified at time of analysis.
Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gain full administrative control by reproducing the device's client-side authentication logic. Because the login check runs in the client rather than being enforced server-side, an attacker can craft valid authentication requests without any credentials. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible and carries a CVSS 4.0 base score of 9.3.
Plaintext administrative credential exposure in the Ebyte NE2-D11 firmware management interface allows anyone with physical access to directly observe device credentials without any authentication or tooling. Reported by ICS-CERT under advisory ICSA-26-237-06, the flaw (CWE-522) affects all known firmware versions per CPE data, with a physical attack vector (AV:P) confirming that exploitation requires proximity to the device. Credential capture could enable full administrative control over the device, with downstream risk to industrial operations where the NE2-D11 is deployed. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface exposes credentials to any attacker capable of intercepting network traffic between a user and the device. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects that no authentication is required on the attacker side - only network traffic access is needed to harvest management credentials, which then enable full unauthorized access to device management functionality. Reported by CISA ICS-CERT under advisory ICSA-26-237-06, this vulnerability affects OT/industrial gateway hardware where flat network topologies are common, elevating realistic exploitation risk beyond typical enterprise environments. No public exploit identified at time of analysis and no CISA KEV listing.
Authentication bypass in the Ebyte NE2-D11 firmware web management interface lets unauthenticated remote attackers reach administrative functions that should be gated behind login. The interface fails to consistently enforce authentication, exposing sensitive device configuration for reading, tampering, and denial of service. No public exploit identified at time of analysis, but the flaw is trivially reachable over the network and was disclosed via a CISA ICS advisory (ICSA-26-237-06).