CVE-2026-76945: CWE-603 in Ebyte Ebyte NE2-D11 Firmware

The Ebyte NE2-D11 firmware suffers from CWE-603: Client-Side Authentication Token Manipulation. The device relies on authentication tokens managed on the client side without adequate validation on the server side. This design flaw enables attackers to replay or alter tokens to bypass authentication controls and access administrative functions without authorization. The CVSS v3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network exploitable with low attack complexity, no privileges or user interaction needed, and high confidentiality impact.

An attacker can gain unauthorized administrative access to the device by replaying or manipulating authentication tokens due to insufficient server-side validation. This compromises the confidentiality of administrative functions but does not affect integrity or availability according to the CVSS vector. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict network access to the device and monitor for suspicious authentication attempts. Avoid relying on client-managed tokens without server validation.