# CVE-2026-73839: Ebyte NE2-D11 plaintext credentials in management interface

Source: https://junglewise.ai/threats/cve-2026-73839-ebyte-ne2-d11-plaintext-credentials-in-management-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73839 · Severity: medium · CVSS 4.6 · Published 2026-08-28

The Ebyte NE2-D11 network gateway device stores and displays administrative credentials in plaintext within its web-based management interface. An attacker with physical access to a device screen or network visibility into management traffic could observe and capture these credentials, leading to unauthorized administrative access and full device compromise.

Technologies: [Ebyte NE2-D11](https://junglewise.ai/threats/technologies/ne2-d11). Vendors: [Ebyte](https://junglewise.ai/threats/vendors/ebyte).

## Quick answers

**Is CVE-2026-73839 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73839 being exploited in the wild.

**How severe is CVE-2026-73839?** Medium severity, with a CVSS score of 4.6, published 28 August 2026.

**Which products and versions are affected?** Ebyte NE2-D11 Firmware FW-9167-0-11.

**Is there a fix for CVE-2026-73839?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-73839 attacked?** It is attacked with physical access or from the adjacent network.

**Am I affected by CVE-2026-73839?** Check whether you run Ebyte NE2-D11 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability (CWE-522: Insufficiently Protected Credentials) occurs when the Ebyte NE2-D11 management interface fails to mask or encrypt administrative credentials displayed in the web UI. The plaintext exposure allows attackers with physical access to the device screen or the ability to monitor network traffic to the management interface to directly read valid credentials. No authentication or user interaction is required to observe the credentials once the management interface is accessed. A patch is under development but has not yet been released by Ebyte.

## Affected products

- Ebyte NE2-D11 Firmware FW-9167-0-11

## Timeline

- 2026-08-25: disclosed
- 2026-08-28: advisory

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06](https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06)

## Related threats

- [Ebyte NE2-D11 credentials exposure in configuration export](https://junglewise.ai/threats/cve-2026-77975-ebyte-ne2-d11-credentials-exposure-in-configuration-export)
- [Ebyte NE2-D11 privilege escalation via missing authorization](https://junglewise.ai/threats/cve-2026-77966-ebyte-ne2-d11-privilege-escalation-via-missing-authorization)
- [Ebyte NE2-D11 weak authentication hashing](https://junglewise.ai/threats/cve-2026-76133-ebyte-ne2-d11-weak-authentication-hashing)
- [Ebyte NE2-D11 missing authentication in management interface](https://junglewise.ai/threats/cve-2026-73819-ebyte-ne2-d11-missing-authentication-in-management-interface)
- [Ebyte NE2-D11 authentication bypass in configuration utility](https://junglewise.ai/threats/cve-2026-77977-ebyte-ne2-d11-authentication-bypass-in-configuration-utility)