Ebyte NE2-D11 Gateway Multiple Vulnerabilities
First seen Aug 26, 2026 · Updated Aug 26, 2026 · CVSS 9.8
The Ebyte NE2-D11 gateway (Firmware FW-9167-0-11) contains eleven distinct vulnerabilities including missing authentication, client-side authentication bypass, cleartext credential and MQTT traffic transmission, CSRF, clickjacking, and missing authorization checks. Several flaws are rated CVSS 9.8, allowing an unauthenticated remote attacker to fully compromise device confidentiality, integrity, and availability. Ebyte has not released a patch or responded to CISA coordination requests, leaving affected deployments in critical manufacturing and energy sectors exposed with no vendor remediation timeline.
Technical Analysis
The advisory documents 11 CVEs affecting Ebyte NE2-D11 firmware FW-9167-0-11, the most severe being CVE-2026-73125, CVE-2026-71187, CVE-2026-76179, and CVE-2026-69658, each scoring CVSS v3.1 9.8, stemming from missing authentication (CWE-306), client-side authentication logic that attackers can reproduce (CWE-603), and cleartext transmission of MQTT credentials and control traffic (CWE-319). Additional issues include insufficiently protected plaintext credentials (CVE-2026-73839, CWE-522), CSRF (CVE-2026-75814, CWE-352), clickjacking via missing frame restrictions (CVE-2026-75548, CWE-1021), lack of authentication attempt throttling enabling brute force (CVE-2026-76940, CWE-307), and missing server-side authorization on configuration endpoints (CVE-2026-75813, CWE-862). Combined, these flaws allow an unauthenticated network attacker to bypass login, intercept or replay session tokens, read credentials in cleartext, and fully reconfigure or disrupt the device with no user interaction required in most cases. No public exploitation has been reported and Ebyte has not delivered a patch despite CISA outreach, so mitigation currently relies on network isolation. If these gateways sit on networks that host or connect to AI agent orchestration systems (e.g., industrial IoT telemetry feeding into RAG pipelines or agent-driven automation), the exposed MQTT credentials and unauthenticated admin access could let attackers pivot to poison agent inputs, exfiltrate API keys transiting the gateway, or disrupt agent-controlled operational workflows.
Affected Systems
Ebyte NE2-D11 gateway devices running Firmware FW-9167-0-11; web management interface and MQTT communication channel components.
Indicators of Compromise
- No specific IOCs (hashes, IPs, domains) published; advisory concerns unpatched vulnerabilities rather than an observed exploitation campaign.
Remediation Steps
- 1
Isolate affected devices
Remove Ebyte NE2-D11 gateways from direct internet exposure; place them behind firewalls and segment them from business and agent-facing networks.
- 2
Restrict remote access
If remote management is required, use an updated, well-configured VPN rather than exposing the web interface directly.
- 3
Contact vendor
Engage Ebyte directly for patch status, as CISA has received no confirmation of an available fix; monitor for firmware updates.
- 4
Enforce network-layer encryption
Wrap MQTT and management traffic in TLS/VPN tunnels to mitigate cleartext credential and control data exposure.
- 5
Monitor authentication activity
Implement external rate limiting or IDS/IPS rules to detect brute-force attempts given the lack of built-in lockout protections.
- 6
Audit connected agent/automation systems
Review any AI agent, automation, or telemetry pipelines that consume data from or authenticate through this gateway, and rotate any credentials or API keys that may have transited the device in cleartext.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.