Do Son 
TL;DR
CISA disclosed 11 Ebyte NE2-D11 vulnerabilities on August 25, 2026. Four carry a critical 9.8 CVSS score. Attackers could seize full control of the gateway, and no patch is confirmed available yet.
Why These Ebyte NE2-D11 Vulnerabilities Matter
The NE2-D11 is an industrial IoT gateway from China-based Ebyte. It links serial and MQTT devices in factories and energy sites. CISA lists the affected sectors as critical manufacturing and energy, deployed worldwide.
These Ebyte NE2-D11 vulnerabilities stack up fast. Researcher Jithin Nambiar reported the full set to CISA. Because many flaws need no login, the risk to exposed gateways is high.
How the Attacks Work
Several bugs share one theme: weak authentication. CISA warns the device does not consistently enforce authentication before granting access to administrative functionality.
As a result, a remote attacker can read config, change settings, or knock the device offline.
Other flaws widen the gap. The gateway relies on client-side authentication logic that attackers can copy. It also sends MQTT credentials and control traffic in cleartext. Consequently, network snoopers can impersonate devices and hijack sessions.
Is It Being Exploited?
No exploitation in the wild has been confirmed. CISA states no known public exploitation has been reported. Likewise, no public proof-of-concept exists at this time.
Affected Versions
The advisory names NE2-D11 firmware version FW-9167-0-11. Users on that build should treat every internet-facing gateway as at risk.
Patch and Mitigation Steps
No fix is confirmed. CISA says Ebyte acknowledged the reports and indicated a patch was under development. However, the vendor has not responded to later coordination requests, so users should contact Ebyte directly.
Meanwhile, follow CISA’s defensive advice in the official ICS advisory ICSA-26-237-06. Keep control devices off the public internet. Place them behind firewalls, and use a VPN for remote access.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
