As cited
Copy frozen at (site build).
vulnerabilities
Ebyte NE2-D11
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Ebyte NE2-D11
CISA disclosed 11 vulnerabilities in Ebyte NE2-D11 gateway firmware FW-9167-0-11 affecting critical manufacturing and energy sectors worldwide. The issues include missing authentication, cleartext transmission of credentials and MQTT traffic, client-side authentication bypass, CSRF, and missing authorization checks that collectively allow remote attackers to gain administrative access, modify configurations, and disrupt device operations. Ebyte acknowledged the reports and indicated patch development but has not provided status updates to CISA.
Why it matters: Organizations operating Ebyte NE2-D11 gateways in critical manufacturing and energy infrastructure should immediately contact the vendor for patch availability and implement network segmentation, as multiple critical-severity vulnerabilities (CVE-2026-73125, CVE-2026-71187, CVE-2026-76179, CVE-2026-69658) enable unauthenticated remote administrative compromise without a patch.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Ebyte NE2-D11
CISA disclosed 11 vulnerabilities in Ebyte NE2-D11 gateway firmware FW-9167-0-11 affecting critical manufacturing and energy sectors worldwide. The issues include missing authentication, cleartext transmission of credentials and MQTT traffic, client-side authentication bypass, CSRF, and missing authorization checks that collectively allow remote attackers to gain administrative access, modify configurations, and disrupt device operations. Ebyte acknowledged the reports and indicated patch development but has not provided status updates to CISA.
Why it matters: Organizations operating Ebyte NE2-D11 gateways in critical manufacturing and energy infrastructure should immediately contact the vendor for patch availability and implement network segmentation, as multiple critical-severity vulnerabilities (CVE-2026-73125, CVE-2026-71187, CVE-2026-76179, CVE-2026-69658) enable unauthenticated remote administrative compromise without a patch.
- Source published
- First seen by Cybersecurity Tracker