An authentication token exposed through GET request query strings in the Ebyte NE2-D11 gateway web interface allows attackers with access to visible session information to capture a valid token. The compromised token can be reused to impersonate an authenticated user, giving the attacker full control over device management features. The flaw stems from insufficient protection of authentication tokens during client‑side session handling and is classified as CWE‑598.

This issue affects the Ebyte NE2-D11 firmware, which is used in certain gateway devices. No additional vendor or product variants were listed, and no version range was supplied in the CNA data; therefore any installed instance of the NE2‑D11 firmware that contains the vulnerable web interface is potentially exposed.

The CVSS score of 9.3 indicates critical severity, and the absence of a publicly available EPSS score means the exploit probability is not quantified but could be high due to the straightforward nature of the attack. The vulnerability is not currently listed in the CISA KEV catalog, suggesting no verified exploitation is known at this time. However, the attack vector is likely remote over the network, exploiting the GET‑based web interface; an attacker who can observe or inject traffic to the device can obtain the token and then perform unauthorized management actions.