CVE-2026-73839: Ebyte NE2-D11 Insufficiently Protected Credentials

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-08-31
Weakness: CWE-522

Description

Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the risk of credential compromise through visual or remote observation. This undermines the confidentiality of device access.

Affected products

Ebyte NE2-D11 Firmware: FW-9167-0-11

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06

Get alerted when CVE-2026-73839 or the next vulnerability affects your stack