A 9.8 CVSS Score and No Patch. That’s a Problem.
CISA published advisory ICSA-26-237-06 on August 25, 2026 about the Ebyte NE2-D11, a serial device server used in manufacturing and energy environments. The firmware version FW-9167-0-11 has eleven separate vulnerabilities, and four of them score a 9.8 out of 10 on the CVSS severity scale. That’s about as bad as it gets.
What makes this worse is that Ebyte acknowledged the report, said a patch was coming, and then went quiet. CISA has no confirmed patch release date. So right now, if you have one of these devices on your network, there’s nothing to install and no timeline to wait for. The one bit of good news is that CISA knows of no public exploitation so far.
What the Vulnerabilities Actually Mean for Your Business
The NE2-D11 is a small piece of hardware that connects older serial equipment to a network. Think older industrial controllers, legacy sensors, or equipment that predates modern networking. A lot of small manufacturers and facilities in NJ still run this kind of gear.
The flaws here are not subtle. One of the critical issues is that the device’s web management interface doesn’t consistently require a login before letting someone in. An attacker who can reach the device over the network can potentially read its configuration, change settings, or take it offline entirely, without ever entering a username or password.
On top of that, the advisory lists cleartext transmission of sensitive information, meaning credentials can be intercepted in transit. There’s also a cross-site request forgery flaw, which lets an attacker trick a logged-in user into making changes they didn’t intend to make. And the device doesn’t properly limit failed login attempts, so brute-force attacks are on the table too.
Put those together and you’ve got a device that’s essentially wide open if it’s reachable from the internet or even from a poorly segmented internal network.
Do You Even Have One of These on Your Network?
That’s the first question. A lot of smaller businesses inherit hardware from previous owners, vendors, or integrators and have no idea what’s actually sitting on their network. At plenty of sites nobody can say what half the devices on the switch are.
A basic network scan using something like Nmap or a dedicated asset discovery tool will show you what’s connected. Go easy on industrial segments, though: older OT devices can crash under an aggressive scan, so use a light scan and run it outside production hours. If you’re using a managed firewall or an endpoint management platform, you may already have this visibility. If you don’t, that’s worth fixing regardless of this specific advisory.
What to Do Right Now if You Have This Device
Since there’s no patch, you’re working with compensating controls. Here’s what I’d prioritize.
First, take the device off any public-facing network segment immediately. It should not be reachable from the internet under any circumstances. If it is, that needs to change today, not next week.
Second, put it behind a firewall rule that only allows access from specific internal IP addresses. Network segmentation is your best friend here. If only one workstation or one management VLAN needs to talk to this device, lock it down to exactly that.
Third, disable the web management interface entirely if your operation doesn’t require it. Some of these devices allow you to turn off the HTTP interface, which removes a major attack surface even without a patch.
Fourth, log any access attempts to or from the device. If something is actively probing it, you want to know.
Finally, reach out to Ebyte directly. CISA’s advisory says users are encouraged to contact the vendor. It’s unlikely to move fast, but it’s worth asking whether a firmware update is actually coming and on what timeline.
The Bigger Lesson Here
This advisory is a good reminder that industrial and operational technology devices often get overlooked in security reviews. IT teams focus on servers, laptops, and firewalls. The little serial converter sitting in a cabinet for five years rarely gets the same attention, and vendors of that hardware don’t always have the same patch culture as Microsoft or Cisco.
If you’re running any kind of OT or legacy networked hardware and you’re not sure what firmware it’s on or whether it’s been reviewed recently, that’s worth putting on your next IT agenda.
If you want help auditing what’s actually on your network, Exine works with small and mid-size businesses across NJ and NYC to do exactly that.
