Someone left the control-room door wide open, but the control room is in a building most people have never heard of
CVE-2026-73125 is a missing-authentication flaw (CWE-306) in the web management interface of the Ebyte NE2-D11 (firmware FW-9167-0-11) and NA111-M (firmware 9013-2-17) serial-to-Ethernet gateways. These are budget industrial Modbus/TCP gateways that bridge RS-485 serial PLCs and field devices to Ethernet. An unauthenticated remote attacker who can reach the management web UI can read sensitive configuration, change device settings (including Modbus mappings), or crash the device — no credentials needed. The CISA ICS advisories ICSA-26-237-06 and ICSA-26-239-05 cover a family of 13 CVEs against these two models, indicating systemic security-design failures, not a one-off bug.
The vendor CVSS of 9.8 CRITICAL is technically defensible for the vulnerability primitive: unauthenticated, low-complexity, full CIA impact. But it ignores deployment reality. These are niche, low-cost Chinese ICS gateways with a small Western enterprise footprint. Per ICS best practice (and CISA's own guidance), they should sit behind an industrial DMZ, unreachable from corporate or internet networks. There is no patch, no known exploitation, and EPSS sits at the 0.53-percentile mark. We downgrade to HIGH 7.5 because the device *is* an OT component by definition — its blast radius touches PLCs and physical processes — but the tiny installed base and expected network isolation prevent a CRITICAL call.
3 steps from start to impact.
Identify exposed Ebyte gateway
- Network reachability to the device's management port (TCP/80)
- ICS best practice places these devices on isolated OT VLANs behind industrial firewalls
- Most enterprise environments do not expose serial gateway management interfaces to the corporate LAN, let alone the internet
- Ebyte devices have a very small footprint in Western enterprise/critical-infrastructure networks
Access admin interface without credentials
curl suffices.- Step 1 completed — management port is reachable
- None once the port is reachable — the vulnerability is trivially exploitable
- However, the attacker must already have internal OT network access or the device must be internet-exposed
Modify Modbus mappings or disrupt gateway
- Step 2 completed — authenticated admin session established (trivially)
- Impact is confined to the serial devices behind *that specific gateway* — typically a small number of PLCs or sensors
- Safety-instrumented systems (SIS) should operate independently of this gateway
- Modbus/TCP traffic modification would need to be sustained to cause lasting process impact
- Web application firewall (WAF) — these are embedded device web servers, not applications behind a reverse proxy. A WAF cannot be inserted in front of the device management interface in typical OT deployments.
- Firmware updates from Ebyte — no patch exists as of 2026-08-29 and the vendor is non-responsive to CISA. Do not wait for a fix.
- Changing default credentials — the vulnerability is *missing authentication*, not weak credentials. Even if you set a strong password, the device does not consistently enforce auth checks on admin endpoints.
The supporting signals.
| In-the-Wild Exploitation | No known exploitation. Not listed on CISA KEV. No campaigns or threat-actor attribution reported as of 2026-08-29. |
|---|---|
| Proof-of-Concept | None published. No public PoC repos or researcher write-ups. Exploitation is trivial (unauthenticated HTTP requests), so a formal PoC is almost redundant. |
| EPSS | 0.0053 (0.53rd percentile) — very low predicted exploitation probability in the next 30 days. |
| KEV Status | Not listed. No CISA KEV entry as of 2026-08-29. |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 CRITICAL. CVSS v4.0: 9.3 CRITICAL. Full network-facing, no-auth, full-impact primitive. |
| Affected Products | Ebyte NE2-D11 firmware FW-9167-0-11; Ebyte NA111-M firmware 9013-2-17. Both are RS-485-to-Ethernet Modbus/TCP serial gateways. |
| Fixed Version | No patch available. Ebyte acknowledged the report but has not delivered a fix. CISA has received no further communication from the vendor. |
| Scanning / Exposure | No specific Shodan/Censys/FOFA census data available for Ebyte gateways. Installed base is expected to be small in Western enterprises — Ebyte is a budget Chinese IoT module manufacturer (cdebyte.com / ebyteiot.com). |
| Disclosure Date | 2026-08-27 (NVD published). Reserved 2026-08-20. CISA ICS advisories ICSA-26-237-06 and ICSA-26-239-05. |
| Researcher / Reporter | Jithin Nambiar reported to CISA. 13 CVEs across the two device models indicate a coordinated audit of the entire firmware. |
Sources.
Why this verdict
- Trivial exploitability keeps the base high. Unauthenticated HTTP access to admin functions requires zero skill, zero tooling, and zero user interaction. The CVSS 9.8 primitive is accurate for the vulnerability itself.
- Network isolation is the primary friction. Per ICS security architecture (IEC 62443, CISA recommendations), these gateways should sit on isolated OT VLANs behind industrial firewalls. An attacker must already have OT-network access or the device must be internet-exposed — both narrow the reachable population significantly.
- Tiny installed base limits enterprise relevance. Ebyte is a budget Chinese IoT module vendor. Western critical-infrastructure operators overwhelmingly use Moxa, Advantech, or Siemens for serial gateways. The fraction of enterprise ICS environments running Ebyte gateways is likely <1%.
- Role multiplier: OT/ICS gateway — verdict floor is HIGH. The NE2-D11 and NA111-M are Modbus gateways connecting PLCs and field devices to Ethernet. 100% of installs occupy an OT role by definition. Compromise allows modification of Modbus register mappings, potentially causing incorrect PLC commands or loss of process visibility. Blast radius per device: PLC-segment-scale, with potential operational/safety implications if SIS is not independent. This floors the verdict at HIGH despite the small installed base.
- No patch and non-responsive vendor. Ebyte acknowledged the vulnerabilities but has gone silent. Defenders cannot remediate by patching; they must rely entirely on compensating controls, which keeps urgency elevated.
Why not higher?
Despite being an OT/ICS component (which would normally floor at CRITICAL for canonical ICS vendors), Ebyte's market share in Western critical infrastructure is negligible — these are budget serial gateways, not Siemens S7s or Rockwell ControlLogix. The installed base evidence suggests well under 1% of enterprise ICS environments use Ebyte gateways, breaking the CRITICAL floor. No known exploitation, no PoC, and 0.53-percentile EPSS further argue against CRITICAL.
Why not lower?
The device is an OT component by definition — its blast radius directly touches PLC communications and physical processes. Even with expected network isolation, the vulnerability is trivially exploitable (zero-click, no auth), the vendor is non-responsive with no patch available, and CISA has issued formal ICS advisories. Downgrading below HIGH would ignore the safety-relevant blast radius of a Modbus gateway compromise.
Crowdsourced verification payload.
Run this script from any Linux host on the same network as the Ebyte gateway. Provide the device IP as an argument: ./check_ebyte_auth.sh 192.168.1.100. No special privileges required — it just sends unauthenticated HTTP requests.
#!/usr/bin/env bash
# check_ebyte_auth.sh — CVE-2026-73125 verification
# Tests whether the Ebyte web management interface serves admin content without authentication.
# Usage: ./check_ebyte_auth.sh <device_ip> [port]
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN
set -euo pipefail
TARGET="${1:?Usage: $0 <device_ip> [port]}"
PORT="${2:-80}"
URL="http://${TARGET}:${PORT}"
echo "[*] CVE-2026-73125 checker for Ebyte NE2-D11 / NA111-M"
echo "[*] Target: ${URL}"
# Try to access common admin/config endpoints without any auth
for path in "/" "/config" "/setting" "/system" "/network" "/serial" "/modbus"; do
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 --max-time 10 "${URL}${path}" 2>/dev/null || echo "000")
if [[ "$HTTP_CODE" == "200" ]]; then
BODY=$(curl -s --connect-timeout 5 --max-time 10 "${URL}${path}" 2>/dev/null || true)
# Look for signs of admin/config content in the response
if echo "$BODY" | grep -qiE '(baud|serial|modbus|gateway|firmware|password|config|setting|network|ip.?addr)'; then
echo "[!] VULNERABLE — unauthenticated access to admin content at ${URL}${path}"
echo "[!] Response contains configuration keywords (serial/modbus/gateway/firmware)"
echo "VULNERABLE"
exit 0
fi
fi
done
# Check if device responded at all
BASE_CODE=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 --max-time 10 "${URL}/" 2>/dev/null || echo "000")
if [[ "$BASE_CODE" == "000" ]]; then
echo "[?] UNKNOWN — could not connect to ${URL}. Device may be offline or port is wrong."
echo "UNKNOWN"
exit 2
fi
if [[ "$BASE_CODE" == "401" || "$BASE_CODE" == "403" ]]; then
echo "[+] PATCHED — device returned HTTP ${BASE_CODE}, authentication appears to be enforced."
echo "PATCHED"
exit 1
fi
echo "[?] UNKNOWN — device responded (HTTP ${BASE_CODE}) but admin content pattern not matched."
echo "[?] Manual verification recommended."
echo "UNKNOWN"
exit 2