CVE-2026-8173

The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.certvde.com/en/advisories/VDE-2026-061/

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-24 07:16

Updated : 2026-09-03 16:57

NVD link : CVE-2026-8173

Mitre link : CVE-2026-8173

CVE.ORG link : CVE-2026-8173

JSON object : View

Products Affected

No product.

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2026-8173", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8173", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-27T16:11:35.747277Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "info@cert.vde.com", "affectedData": [{"vendor": "Murrelektronik", "product": "Xelity 4TX M GE", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 4TX M GE PN", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 6TX M GE", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 6TX M GE PN", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 8TX M GE", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 8TX M GE PN", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity-16TX-M-GE", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity-16TX-M-GE-PN", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M FE 4P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M FE PN 4P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 8 +2 TX IP67 M GE 4P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 8 +2 TX IP67 M GE PN 4P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M GE 4P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M GE PN 4P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 6TX 4PW IP67 M GE PN 4P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M FE 5P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M FE PN 5P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 8 +2 TX IP67 M GE 5P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 8 +2 TX IP67 M GE PN 5P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M GE 5P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M GE PN 5P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 6TX 4PW IP67 M GE PN 5P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "6 TX M GE + 4 Power M12 IP67", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-24T07:16:54.570", "references": [{"url": "https://www.certvde.com/en/advisories/VDE-2026-061/", "source": "info@cert.vde.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools."}], "lastModified": "2026-09-03T16:57:26.583", "sourceIdentifier": "info@cert.vde.com"}