Ebyte device web management interface does not consistently enforce authentication before granting access…

CVE-2026-73125 is a missing-authentication flaw (CWE-306) in the web management interface of the Ebyte NE2-D11 (firmware FW-9167-0-11) and NA111-M (firmware 9013-2-17) serial-to-Ethernet gateways. These are budget industrial Modbus/TCP gateways that bridge RS-485 serial PLCs and field devices to Ethernet. An unauthenticated remote attacker who can reach the management web UI can read sensitive configuration, change device settings (including Modbus mappings), or crash the device — no credentials needed. The CISA ICS advisories ICSA-26-237-06 and ICSA-26-239-05 cover a family of 13 CVEs against these two models, indicating systemic security-design failures, not a one-off bug.

The vendor CVSS of 9.8 CRITICAL is technically defensible for the vulnerability primitive: unauthenticated, low-complexity, full CIA impact. But it ignores deployment reality. These are niche, low-cost Chinese ICS gateways with a small Western enterprise footprint. Per ICS best practice (and CISA's own guidance), they should sit behind an industrial DMZ, unreachable from corporate or internet networks. There is no patch, no known exploitation, and EPSS sits at the 0.53-percentile mark. We downgrade to HIGH 7.5 because the device *is* an OT component by definition — its blast radius touches PLCs and physical processes — but the tiny installed base and expected network isolation prevent a CRITICAL call.

Why this verdict

• Trivial exploitability keeps the base high. Unauthenticated HTTP access to admin functions requires zero skill, zero tooling, and zero user interaction. The CVSS 9.8 primitive is accurate for the vulnerability itself.
• Network isolation is the primary friction. Per ICS security architecture (IEC 62443, CISA recommendations), these gateways should sit on isolated OT VLANs behind industrial firewalls. An attacker must already have OT-network access or the device must be internet-exposed — both narrow the reachable population significantly.
• Tiny installed base limits enterprise relevance. Ebyte is a budget Chinese IoT module vendor. Western critical-infrastructure operators overwhelmingly use Moxa, Advantech, or Siemens for serial gateways. The fraction of enterprise ICS environments running Ebyte gateways is likely <1%.
• Role multiplier: OT/ICS gateway — verdict floor is HIGH. The NE2-D11 and NA111-M are Modbus gateways connecting PLCs and field devices to Ethernet. 100% of installs occupy an OT role by definition. Compromise allows modification of Modbus register mappings, potentially causing incorrect PLC commands or loss of process visibility. Blast radius per device: PLC-segment-scale, with potential operational/safety implications if SIS is not independent. This floors the verdict at HIGH despite the small installed base.
• No patch and non-responsive vendor. Ebyte acknowledged the vulnerabilities but has gone silent. Defenders cannot remediate by patching; they must rely entirely on compensating controls, which keeps urgency elevated.

Why not higher?

Despite being an OT/ICS component (which would normally floor at CRITICAL for canonical ICS vendors), Ebyte's market share in Western critical infrastructure is negligible — these are budget serial gateways, not Siemens S7s or Rockwell ControlLogix. The installed base evidence suggests well under 1% of enterprise ICS environments use Ebyte gateways, breaking the CRITICAL floor. No known exploitation, no PoC, and 0.53-percentile EPSS further argue against CRITICAL.

Why not lower?

The device is an OT component by definition — its blast radius directly touches PLC communications and physical processes. Even with expected network isolation, the vulnerability is trivially exploitable (zero-click, no auth), the vendor is non-responsive with no patch available, and CISA has issued formal ICS advisories. Downgrading below HIGH would ignore the safety-relevant blast radius of a Modbus gateway compromise.

1. Isolate Ebyte gateways on a dedicated OT VLAN with no route to corporate or internet networks — This is the single most effective control. Use industrial firewalls (e.g., Palo Alto OT Security, Fortinet FortiGate Rugged) to restrict all inbound traffic to the gateway's management port. Deploy within the noisgate mitigation SLA of 30 days for HIGH severity. If the gateway is currently internet-exposed, isolate it immediately.
2. Block HTTP/HTTPS access to the gateway management interface from all hosts except a hardened jump box — Create ACLs or firewall rules that permit management-port access only from a single, hardened OT admin workstation. This reduces the attack surface to a single pivot point. Deploy within 30 days.
3. Deploy OT network monitoring (Dragos, Claroty, or Nozomi) — Monitor for anomalous HTTP connections to serial gateways and for unexpected Modbus register-value changes. These platforms can detect exploitation of this CVE in real time even without a patch.
4. Plan hardware replacement with a supported vendor — Since Ebyte is non-responsive and no patch is forthcoming, evaluate replacing affected gateways with Moxa, Advantech, or Siemens equivalents that have active security response programs. Target replacement within the noisgate remediation SLA of 180 days for HIGH severity.

Run this script from any Linux host on the same network as the Ebyte gateway. Provide the device IP as an argument: ./check_ebyte_auth.sh 192.168.1.100. No special privileges required — it just sends unauthenticated HTTP requests.

#!/usr/bin/env bash
# check_ebyte_auth.sh — CVE-2026-73125 verification
# Tests whether the Ebyte web management interface serves admin content without authentication.
# Usage: ./check_ebyte_auth.sh <device_ip> [port]
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:?Usage: $0 <device_ip> [port]}"
PORT="${2:-80}"
URL="http://${TARGET}:${PORT}"

echo "[*] CVE-2026-73125 checker for Ebyte NE2-D11 / NA111-M"
echo "[*] Target: ${URL}"

# Try to access common admin/config endpoints without any auth
for path in "/" "/config" "/setting" "/system" "/network" "/serial" "/modbus"; do
  HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 --max-time 10 "${URL}${path}" 2>/dev/null || echo "000")
  if [[ "$HTTP_CODE" == "200" ]]; then
    BODY=$(curl -s --connect-timeout 5 --max-time 10 "${URL}${path}" 2>/dev/null || true)
    # Look for signs of admin/config content in the response
    if echo "$BODY" | grep -qiE '(baud|serial|modbus|gateway|firmware|password|config|setting|network|ip.?addr)'; then
      echo "[!] VULNERABLE — unauthenticated access to admin content at ${URL}${path}"
      echo "[!] Response contains configuration keywords (serial/modbus/gateway/firmware)"
      echo "VULNERABLE"
      exit 0
    fi
  fi
done

# Check if device responded at all
BASE_CODE=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 --max-time 10 "${URL}/" 2>/dev/null || echo "000")
if [[ "$BASE_CODE" == "000" ]]; then
  echo "[?] UNKNOWN — could not connect to ${URL}. Device may be offline or port is wrong."
  echo "UNKNOWN"
  exit 2
fi

if [[ "$BASE_CODE" == "401" || "$BASE_CODE" == "403" ]]; then
  echo "[+] PATCHED — device returned HTTP ${BASE_CODE}, authentication appears to be enforced."
  echo "PATCHED"
  exit 1
fi

echo "[?] UNKNOWN — device responded (HTTP ${BASE_CODE}) but admin content pattern not matched."
echo "[?] Manual verification recommended."
echo "UNKNOWN"
exit 2

Sources

1. CISA ICS Advisory — Ebyte NE2-D11 (ICSA-26-237-06)
2. CISA ICS Advisory — Ebyte NA111-M (ICSA-26-239-05)
3. CVE-2026-73125 — THREATINT
4. Ebyte NE2-D11 Product Page
5. Ebyte NA111-M Product Page
6. Assurant Cyber — Ebyte NE2-D11 Advisory Summary
7. NE2 Series Product Blog — Ebyte