Ebyte NE2-D11 flaws grant admin access to critical infrastructure
Ebyte acknowledged the nine vulnerabilities then went silent on CISA coordination, leaving operators no patch timeline for a device that transmits credentials in cleartext.
TL;DR
CISA published an advisory on nine vulnerabilities in Ebyte NE2-D11 gateways deployed in critical manufacturing and energy infrastructure worldwide. The flaws allow unauthenticated remote attackers to gain administrative control, intercept cleartext credentials, hijack sessions, and disrupt operations. Ebyte acknowledged the report and said a patch was under development, then stopped responding to CISA coordination requests. No patch timeline exists. Operators are left with the standard ICS mitigations: network isolation, firewalls, VPNs. None fully address the risk for a device whose purpose is to connect networks.
The Ebyte advisory fits a pattern ICS operators have seen before: a vendor acknowledges vulnerabilities, says a patch is coming, and then stops answering CISA's calls. In October 2023, CISA published an advisory for Dingtian DT-R002 relay boards with the same note, "Dingtian has not responded to requests to work with CISA to mitigate this vulnerability." Two and a half years later, the pattern repeats with a different Chinese vendor and a more consequential device class.
The NE2-D11 is an industrial IoT gateway that bridges serial and Ethernet networks, the kind of device that sits at the boundary between IT and OT and, if compromised, gives an attacker a pivot point into both. The nine vulnerabilities CISA catalogued in ICSA-26-237-06 aren't subtle. CVE-2026-73125 (CVSS 9.8) and CVE-2026-71187 (CVSS 9.8) both allow unauthenticated attackers to reach administrative functions directly, the first because the web interface doesn't consistently check authentication before serving admin pages, the second because authentication logic runs client-side and can be reproduced by anyone who inspects the JavaScript. CVE-2026-73809 (CVSS 7.5) confirms the management interface transmits credentials and session data in cleartext. CVE-2026-73839 (CVSS 4.6) notes that administrative passwords are displayed in plaintext within the interface itself.
The remaining five CVEs fill out a picture of a device whose security model was built without threat assumptions: a CSRF vulnerability that lets an attacker piggyback on an authenticated admin's session (CVE-2026-75814, CVSS 8.8), authentication tokens exposed in GET request query strings (CVE-2026-76179, CVSS 9.8), no rate limiting on login attempts (CVE-2026-76940), missing clickjacking protections, and missing authorization checks.
What operators can do Monday
CISA's recommended mitigations are the standard ICS playbook: minimize network exposure, isolate control-system devices behind firewalls, use VPNs for remote access. But for an industrial gateway whose job is to connect things, network isolation is a partial answer at best. The more honest guidance: inventory every NE2-D11 on the network. Verify whether the web management interface is reachable from any untrusted segment. Begin planning for replacement if Ebyte remains unresponsive. CISA hasn't issued a binding operational directive for this advisory, and given the vendor's posture, operators shouldn't expect one to trigger a patch timeline.
The NE2-D11 is deployed worldwide in critical manufacturing and energy. Every day the vendor stays silent is another day those gateways sit on operational networks with administrative doors wide open.
Published ·Deep Fathom