EUVD-2026-29484
GHSA-rp4q-4mm5-p2vx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (schneider) · only source for this CVE.
CVSS VectorVendor: schneider
Lifecycle Timeline
3DescriptionCVE.org
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.
AnalysisAI
Schneider Electric EcoStruxure Panel Server can revert credentials to insecure default values under rare circumstances, allowing remote unauthenticated attackers to gain unauthorized access using known factory credentials. This CWE-1188 vulnerability enables complete confidential information disclosure (CVSS 8.2 High). Exploitation requires specific timing conditions (AT:P - Attack Timing: Present) to catch the window when credentials reset. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis, suggesting targeted rather than widespread exploitation risk.
Technical ContextAI
This is a CWE-1188 (Initialization of a Resource with an Insecure Default) vulnerability affecting Schneider Electric's EcoStruxure Panel Server, an industrial automation platform used for HMI/SCADA applications in building management and energy systems. The flaw involves improper credential lifecycle management where authentication credentials can unexpectedly revert to factory-default values during specific operational conditions. Unlike typical credential issues, this represents a state regression vulnerability where secure configurations spontaneously degrade. The CVSS 4.0 vector indicates network accessibility (AV:N) with low attack complexity (AC:L) but requires specific attack timing conditions (AT:P), meaning exploitation depends on catching the system during its vulnerable state window. Impact is limited to confidentiality breach (VC:H) with no integrity or availability impact, and no scope change beyond the vulnerable component.
RemediationAI
Upgrade to the patched version specified in Schneider Electric Security Notification SEVD-2026-132-04 available at https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-04.pdf. Exact fix version not independently confirmed from available data - consult vendor advisory for release details. Until patching is complete, implement network segmentation to restrict Panel Server access to trusted management networks only, blocking internet-facing exposure entirely (eliminates AV:N attack vector but may limit remote operations capabilities). Deploy continuous credential monitoring to detect unexpected credential changes and trigger immediate password rotation plus audit logging review. Change all default credentials to strong unique passwords and implement automated credential verification checks post-system restart or configuration changes. Establish SOC alerting for authentication attempts using default credential patterns against Panel Server instances. Note that compensating controls cannot eliminate the underlying credential reversion flaw - patching remains the only definitive remediation.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today