Ebyte NE2-D11 (CVE-2026-73125, CVE-2026-73809, CVE-2026-73839 +8 more)

What Happened

A government cybersecurity agency published a warning about multiple security flaws in a piece of industrial networking equipment called the Ebyte NE2-D11. The flaws let attackers remotely take control of the device without needing a password, intercept sensitive data sent over the network, and trick authorized users into making unintended changes. Organizations in manufacturing and energy that use this device are affected. The manufacturer knows about the problems but has not yet released a fix. Until a patch is available, organizations should isolate these devices from the public internet, place them behind firewalls, and use encrypted connections for any remote access.

Key Takeaways

• Eleven vulnerabilities affect Ebyte NE2-D11 firmware FW-9167-0-11, including three rated CVSS 9.8 Critical for missing authentication, client-side authentication bypass, and cleartext MQTT credential transmission.
• No patch is currently available; the vendor acknowledged the reports but has not provided a fix or further coordination.
• Successful exploitation enables unauthenticated remote attackers to gain administrative access, intercept credentials, modify device configuration, hijack sessions, and disrupt device availability.
• Affected sectors include Critical Manufacturing and Energy; devices are deployed worldwide.
• CISA recommends minimizing network exposure, isolating control system networks, and using VPNs for remote access as interim mitigations.

Affected Systems

• Ebyte NE2-D11 Firmware FW-9167-0-11

Vulnerabilities (CVEs)

Attack Chain

1. Reconnaissance: Attacker identifies an internet-accessible Ebyte NE2-D11 web management interface or MQTT endpoint.
2. Initial Access: Attacker exploits missing authentication (CVE-2026-73125) or client-side authentication bypass (CVE-2026-71187) to reach administrative functionality without credentials.
3. Credential Capture: Attacker intercepts cleartext web (CVE-2026-73809) or MQTT (CVE-2026-69658) traffic to steal session tokens or credentials.
4. Session Hijacking: Attacker reuses tokens passed in GET query strings (CVE-2026-76179) or replays client-managed tokens (CVE-2026-76945) to impersonate an authenticated administrator.
5. Persistence/Impact: Attacker modifies device configuration, disrupts availability, or impersonates the device on the MQTT broker.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No detection rules are provided in the advisory. The article is a vulnerability disclosure with mitigation guidance only.

Detection Engineering Assessment

Required Log Sources

• Network flow logs for the segments hosting Ebyte NE2-D11 devices
• Full PCAP or proxy logs for HTTP traffic to the device management interface
• MQTT broker logs if the device connects to a managed broker
• Firewall logs for inbound connections to the device

Hunting Hypotheses

Control Gaps

• Network firewalls permitting inbound access to the Ebyte device management interface from untrusted networks.
• Lack of TLS/encryption on the device management interface and MQTT communications.
• Absence of network-level rate limiting or IPS rules for brute-force protection on the device.
• No device-side logging for authentication events or configuration changes.

Key Behavioral Indicators

• HTTP requests to Ebyte NE2-D11 management endpoints without a valid session cookie or authentication header.
• Cleartext HTTP or MQTT traffic to or from the Ebyte device on the network.
• Repeated authentication attempts from a single source IP exceeding normal baseline rates.
• Configuration change requests to the device originating from referrer URLs outside the organization's domain.

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether your network segmentation policies adequately separate ICS device management networks from business and internet-facing networks.
• Consider deploying an inline TLS-terminating reverse proxy for the device management interface if the device itself cannot enforce HTTPS.
• If your organization operates an MQTT broker, evaluate whether broker-side ACLs and TLS can mitigate the risk of cleartext credential exposure from affected devices.
• Contact Ebyte to request patch availability and firmware update timelines.

User Protection

• Consider disabling or restricting web-based management on Ebyte NE2-D11 devices where CLI or out-of-band management is available.
• If web management is required, evaluate whether browser-based security controls such as Content-Security-Policy enforcement via a reverse proxy can mitigate CSRF and clickjacking risks.
• Ensure administrators accessing the device use dedicated, isolated workstations that are not simultaneously browsing untrusted sites.

Security Awareness

• Consider incorporating ICS-specific social engineering awareness into existing training programs, emphasizing that CSRF and clickjacking attacks can target industrial device administrators.
• Remind personnel that unsolicited links and attachments should not be opened, as they may be used to deliver CSRF payloads against authenticated device sessions.
• Encourage operations teams to report any unexpected device configuration changes or unexpected management interface access prompts.

MITRE ATT&CK Mapping