Executive brief
The Ebyte NE2-D11 is a network gateway device used in industrial and energy infrastructure to manage critical communications and configurations. A low-privileged authenticated user can bypass authorization controls to access administrative functions, modify security settings, and compromise the integrity and availability of the device and the networks it protects.
Technical details
This vulnerability stems from insufficient separation of privileged and unprivileged management functions in the NE2-D11 web interface. A low-privileged authenticated attacker can access security-sensitive configuration functions without proper authorization checks, potentially modifying device settings that affect confidentiality, integrity, and availability. The affected firmware version is FW-9167-0-11. The attack requires valid authentication credentials but no additional user interaction or elevated privilege level. Ebyte acknowledged the issues and indicated patch development, but has not provided status or availability details. CVSS 3.1 score is 8.8 (high severity).
Affected products
- Ebyte NE2-D11 Firmware FW-9167-0-11
Timeline
- 2026-08-25: disclosed
- 2026-08-31: advisory