Description
Ebyte device web management interface does not consistently enforce
authentication before granting access to administrative functionality.
An unauthenticated remote attacker could access sensitive configuration
information, modify device settings, or disrupt availability.
Published: 2026-08-27
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability stems from missing authentication on the web management interface of the Ebyte NE2-D11 firmware, allowing anyone on the network to reach administrative functions. The attacker can read sensitive configuration, change device settings, or shut down services, which compromises confidentiality, integrity, and availability of the device.

Affected Systems

The affected product is the Ebyte NE2‑D11 firmware from Ebyte. No specific version numbers are provided in the available data.

Risk and Exploitability

The CVSS score of 9.3 indicates a high severity condition. EPSS information is unavailable, so the exact likelihood of exploitation is unknown, yet the lack of authentication makes the vulnerability highly exploitable through the web interface. The vulnerability is not yet listed in the CISA KEV catalog. An attacker would likely access the device remotely via the exposed web management interface to gain unrestricted administrative capabilities.

Generated by OpenCVE AI on August 28, 2026 at 07:07 UTC.

Remediation

Vendor Workaround

Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development. However, the vendor has not responded to subsequent requests for coordination, and CISA has not been informed of the status or availability of the patch. Users are encouraged to reach out to Ebyte for more information.

OpenCVE Recommended Actions

  • Reach out to Ebyte to obtain patch status or temporary remediation instructions
  • Apply network-level restrictions to isolate or block the device’s web management interface using firewall rules
  • If possible, disable the web management interface entirely or move it to an isolated VLAN
  • Continuously monitor device logs for unauthorized access attempts and keep firmware updated as soon as a fix becomes available

Generated by OpenCVE AI on August 28, 2026 at 07:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Ebyte
Ebyte ebyte Ne2-d11 Firmware
Vendors & Products Ebyte
Ebyte ebyte Ne2-d11 Firmware

Fri, 28 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability.
Title Ebyte NE2-D11 Missing Authentication for Critical Function
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Ebyte Ebyte Ne2-d11 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2026-08-28T14:13:53.236Z

Reserved: 2026-08-20T15:03:17.014Z

Link: CVE-2026-73125

cve-icon Vulnrichment

Updated: 2026-08-28T14:05:59.969Z

cve-icon NVD

Status : Received

Published: 2026-08-28T00:18:11.273

Modified: 2026-08-28T16:18:24.173

Link: CVE-2026-73125

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T16:13:46Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function