CVE-2026-76940 HIGH

CVE-2026-76940: Ebyte NE2-D11 Improper Restriction of Excessive Authentication Attempts

Vendor Ebyte

Product Ebyte NE2-D11 Firmware

Weakness CWE-307 · Brute force

Published August 27, 2026

Last update August 28, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication.

Key dates

02Disclosure timeline

August 27, 2026 CVE published

August 28, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-76940 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/307.html AskarLabs — CWE-307 write-up Improper Restriction of Excessive Authentication Attempts

Related vulnerabilities

04Related CVE

CVE-2024-32774 WordPress ProfileGrid plugin <= 5.8.2 - Group Members Limit Bypass vulnerability CVE-2024-32720 WordPress Appointment Hour Booking plugin <= 1.4.56 - Captcha Bypass vulnerability CVE-2023-45009 WordPress Captcha for Contact Form 7 plugin <= 1.11.3 - Capcha Bypass vulnerability CVE-2023-48745 WordPress Captcha Code plugin <= 2.9 - Captcha Bypass vulnerability CVE-2024-35747 WordPress Contact Form Builder, Contact Widget plugin <= 2.1.7 - Bypass Vulnerability vulnerability