Organizations using Ebyte NE2-D11 devices should: 1) Isolate affected devices from untrusted networks where possible, 2) Monitor for vendor communications regarding patch availability, 3) Contact Ebyte directly for updates on remediation, 4) Implement network segmentation and strict access controls to limit exposure, 5) Credentials should be rotated if exposure is suspected due to CVE-2026-73839.
CISA has published an advisory detailing 13 vulnerabilities in the Ebyte NA111-M gateway, with CVSS scores up to 9.8. The flaws could allow unauthenticated remote attackers to fully compromise the device, access sensitive information, or disrupt availability. No patch is currently available; Ebyte has not confirmed a timeline.
The Cybersecurity and Infrastructure Security Agency (CISA) has published advisory ICSA-26-237-06 disclosing four vulnerabilities in the Ebyte NE2-D11 firmware (FW-9167-0-11). The flaws span missing authentication for critical functions, cleartext transmission of sensitive information, insufficiently protected credentials, and client-side authentication bypass. CVSS scores reach 9.8, indicating critical severity. Ebyte has acknowledged the issues and stated a patch is under development, but has not coordinated remediation with CISA, and no patch is currently available.