CISA Issues Advisory for Multiple Critical Vulnerabilities in Ebyte NE2-D11 Firmware

The Cybersecurity and Infrastructure Security Agency (CISA) has issued industrial control systems advisory ICSA-26-237-06, revealing four vulnerabilities in the Ebyte NE2-D11 firmware version FW-9167-0-11. The affected device is a gateway product deployed worldwide, with company headquarters located in China.

The first vulnerability, tracked as CVE-2026-73125, is a missing authentication for critical function flaw. The device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability. This flaw has a CVSS v3.1 base score of 9.8 (CRITICAL).

CVE-2026-73809 involves cleartext transmission of sensitive information. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication or session-related information transmitted between a user and the affected device.

CVE-2026-73839 pertains to insufficiently protected credentials. Administrative credentials may be exposed in plaintext within the device's management interface, increasing the risk of credential compromise through visual or remote observation.

The fourth flaw, CVE-2026-71187, describes a client-side authentication bypass. The Ebyte device relies on client-side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain unauthorized administrative access.

Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development. However, the vendor has not responded to subsequent requests for coordination, and CISA has not been informed of the status or availability of the patch. Users are encouraged to reach out to Ebyte for more information.

Relevant CWEs include CWE-306 (Missing Authentication for Critical Function), CWE-319 (Cleartext Transmission of Sensitive Information), CWE-522 (Insufficiently Protected Credentials), and CWE-309 (Client-Side Authentication).

As of the advisory publication date, no confirmed active exploitation in the wild has been reported. However, the high CVSS scores and unauthenticated attack vectors present significant risk to organizations operating these devices.