# CVE-2026-73809: Ebyte NE2-D11 cleartext transmission of sensitive information

Source: https://junglewise.ai/threats/cve-2026-73809-ebyte-ne2-d11-cleartext-transmission-of-sensitive-information  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73809 · Severity: high · CVSS 7.5 · Published 2026-08-28

Ebyte NE2-D11 is an industrial gateway used in critical manufacturing and energy infrastructure. Its web management interface transmits authentication and session information without encryption, allowing attackers on the network to intercept credentials and gain unauthorized access to device management functions. Successful exploitation could compromise device configuration, disrupt operations, and enable further attacks on critical infrastructure.

Technologies: [Ebyte NE2-D11](https://junglewise.ai/threats/technologies/ne2-d11). Vendors: [Ebyte](https://junglewise.ai/threats/vendors/ebyte).

## Quick answers

**Is CVE-2026-73809 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73809 being exploited in the wild.

**How severe is CVE-2026-73809?** High severity, with a CVSS score of 7.5, published 28 August 2026.

**Which products and versions are affected?** Ebyte NE2-D11 FW-9167-0-11.

**Is there a fix for CVE-2026-73809?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-73809 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-73809?** Check whether you run Ebyte NE2-D11 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability (CWE-319) exists in the web management interface of the Ebyte NE2-D11 gateway, which fails to enforce transport-layer encryption (HTTPS) for sensitive communications. The affected firmware version FW-9167-0-11 transmits authentication tokens and session information in cleartext over the network. An attacker with network access (AV:N, AC:L, PR:N, UI:N) can passively intercept these communications to obtain valid credentials or session tokens, leading to unauthorized administrative access. The vendor acknowledged the issue but has not released patches; remediation requires user outreach to Ebyte for patch availability or network-level controls to restrict access to the management interface.

## Affected products

- Ebyte NE2-D11 FW-9167-0-11

## Timeline

- 2026-08-25: disclosed
- 2026-08-28: advisory: CVE-2026-73809 published

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06](https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06)

## Related threats

- [Ebyte NE2-D11 credentials exposure in configuration export](https://junglewise.ai/threats/cve-2026-77975-ebyte-ne2-d11-credentials-exposure-in-configuration-export)
- [Ebyte NE2-D11 privilege escalation via missing authorization](https://junglewise.ai/threats/cve-2026-77966-ebyte-ne2-d11-privilege-escalation-via-missing-authorization)
- [Ebyte NE2-D11 weak authentication hashing](https://junglewise.ai/threats/cve-2026-76133-ebyte-ne2-d11-weak-authentication-hashing)
- [Ebyte NE2-D11 missing authentication in management interface](https://junglewise.ai/threats/cve-2026-73819-ebyte-ne2-d11-missing-authentication-in-management-interface)
- [Ebyte NE2-D11 authentication bypass in configuration utility](https://junglewise.ai/threats/cve-2026-77977-ebyte-ne2-d11-authentication-bypass-in-configuration-utility)