CVE-2026-8173

The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.certvde.com/en/advisories/VDE-2026-061/

Configurations

No configuration.

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) La GUI web de los switches Murrelektronik Xelity afectados registra direcciones MAC de la tabla de direcciones MAC de los dispositivos cuyo un administrador autenticado utiliza la función 'Copiar direcciones MAC aprendidas'. Debido a la generación incorrecta de mensajes de error, un atacante no autenticado con acceso de red a la interfaz web puede recuperar las direcciones MAC registradas a través de las herramientas de desarrollador del navegador.

Information

Published : 2026-08-24 07:16

Updated : 2026-10-14 13:10

NVD link : CVE-2026-8173

Mitre link : CVE-2026-8173

CVE.ORG link : CVE-2026-8173

JSON object : View

Products Affected

No product.

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2026-8173", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8173", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-27T16:11:35.747277Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "info@cert.vde.com", "affectedData": [{"vendor": "Murrelektronik", "product": "Xelity 4TX M GE", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 4TX M GE PN", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 6TX M GE", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 6TX M GE PN", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 8TX M GE", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 8TX M GE PN", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity-16TX-M-GE", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity-16TX-M-GE-PN", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M FE 4P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M FE PN 4P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 8 +2 TX IP67 M GE 4P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 8 +2 TX IP67 M GE PN 4P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M GE 4P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M GE PN 4P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 6TX 4PW IP67 M GE PN 4P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M FE 5P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M FE PN 5P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 8 +2 TX IP67 M GE 5P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 8 +2 TX IP67 M GE PN 5P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M GE 5P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 10 TX IP67 M GE PN 5P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "Xelity 6TX 4PW IP67 M GE PN 5P", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Murrelektronik", "product": "6 TX M GE + 4 Power M12 IP67", "versions": [{"status": "affected", "version": "2.1.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-24T07:16:54.570", "references": [{"url": "https://www.certvde.com/en/advisories/VDE-2026-061/", "source": "info@cert.vde.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools."}, {"lang": "es", "value": "La GUI web de los switches Murrelektronik Xelity afectados registra direcciones MAC de la tabla de direcciones MAC de los dispositivos cuyo un administrador autenticado utiliza la funci\u00f3n 'Copiar direcciones MAC aprendidas'. Debido a la generaci\u00f3n incorrecta de mensajes de error, un atacante no autenticado con acceso de red a la interfaz web puede recuperar las direcciones MAC registradas a trav\u00e9s de las herramientas de desarrollador del navegador."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "info@cert.vde.com"}