CISA flags critical flaws in Ebyte NE2-D11 firmware
CISA issued an advisory on Aug. 25 about multiple vulnerabilities in Ebyte NE2-D11 firmware FW-9167-0-11, saying no public exploitation has been reported and a patch is under development.
CISA on Aug. 25 issued an advisory on multiple critical and high-severity vulnerabilities in Ebyte NE2-D11 firmware FW-9167-0-11. The agency said the flaws could let an attacker gain unauthorized administrative access, view sensitive information, change device settings, hijack sessions or disrupt device operation.
CISA said the product is deployed worldwide and is used in the Critical Manufacturing and Energy sectors. The agency said the vendor has acknowledged the reported issues and that a patch was under development, but CISA has not been told when it will be available.
What CISA said
CISA listed 11 CVEs affecting the product: CVE-2026-73125, CVE-2026-73809, CVE-2026-73839, CVE-2026-71187, CVE-2026-76179, CVE-2026-75814, CVE-2026-76940, CVE-2026-75548, CVE-2026-75813, CVE-2026-76945 and CVE-2026-69658.
CISA gave CVSS v3.1 base scores of 9.8, or critical, to CVE-2026-73125, CVE-2026-71187, CVE-2026-76179 and CVE-2026-69658. It gave CVE-2026-75814 a score of 8.8 high. Several others were rated high at 7.5, while some issues were rated medium.
According to the advisory, the bugs include missing authentication, cleartext transmission of sensitive information, insufficiently protected credentials, client-side authentication weaknesses, cross-site request forgery, lack of rate limiting or lockout for repeated login attempts, improper restriction of rendered UI layers or frames, missing authorization and token-handling weaknesses.
Context and background
CISA said CVE-2026-73125 involves missing authentication for administrative functionality and could allow changes to sensitive configuration or device availability. CVE-2026-73809 involves cleartext transmission of sensitive information. CVE-2026-73839 involves administrative credentials exposed in plaintext.
The agency said CVE-2026-71187 involves client-side authentication that can be reproduced by unauthenticated users, while CVE-2026-76179 concerns insufficient protection of authentication tokens during client-side session handling. CVE-2026-75814 involves a lack of verification of request origin or authenticity, which can let a crafted page trigger unwanted actions if an administrator visits it.
CISA also said CVE-2026-76940 involves no rate limiting or account lockout for repeated authentication attempts, CVE-2026-75548 allows the interface to be rendered in an external frame, CVE-2026-75813 lacks server-side authorization checks on configuration endpoints, CVE-2026-76945 relies on client-managed authentication tokens without enough server-side validation, and CVE-2026-69658 involves MQTT credentials and control traffic sent in cleartext.
What happens next
CISA said Ebyte acknowledged receipt of the vulnerabilities and said a patch was under development. The agency also said the vendor did not respond to later coordination requests and CISA has not been informed of patch status or availability.
CISA said it has not received reports of known public exploitation specifically targeting these vulnerabilities.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()