Skip to main content

Xelity Switches CVE-2026-8173

| EUVDEUVD-2026-64744 MEDIUM
Error Message Information Leak (CWE-209)
2026-08-24 CERTVDE GHSA-f42v-6cfh-6pj5
Information Disclosure Xelity 4Tx M Ge Xelity 4Tx M Ge Pn Xelity 6Tx M Ge Xelity 6Tx M Ge Pn Xelity 8Tx M Ge Xelity 8Tx M Ge Pn Xelity 16Tx M Ge Xelity 16Tx M Ge Pn Xelity 10 Tx Ip67 M Fe 4P Xelity 10 Tx Ip67 M Fe Pn 4P Xelity 8 2 Tx Ip67 M Ge 4P Xelity 8 2 Tx Ip67 M Ge Pn 4P Xelity 10 Tx Ip67 M Ge 4P Xelity 10 Tx Ip67 M Ge Pn 4P Xelity 6Tx 4Pw Ip67 M Ge Pn 4P Xelity 10 Tx Ip67 M Fe 5P Xelity 10 Tx Ip67 M Fe Pn 5P Xelity 8 2 Tx Ip67 M Ge 5P Xelity 8 2 Tx Ip67 M Ge Pn 5P Xelity 10 Tx Ip67 M Ge 5P Xelity 10 Tx Ip67 M Ge Pn 5P Xelity 6Tx 4Pw Ip67 M Ge Pn 5P 6 Tx M Ge 4 Power M12 Ip67
5.3
CVSS 4.0 · Vendor: CERTVDE
Share

Severity by source

Vendor (CERTVDE) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network-accessible web GUI with no authentication barrier; user interaction required (admin must trigger function); low confidentiality impact from MAC disclosure; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CERTVDE).

CVSS VectorVendor: CERTVDE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 24, 2026 - 07:27 vuln.today

DescriptionCVE.org

The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools.

AnalysisAI

Information disclosure in Murrelektronik Xelity industrial Ethernet switches allows unauthenticated network attackers to retrieve MAC addresses from the device when an administrator uses the 'Copy learned MAC Addresses' function. The application improperly exposes logged MAC address data via browser developer tools (CVSS 4.0: 5.3). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Network access to web interface
Delivery
Administrator uses 'Copy learned MAC Addresses'
Exploit
Attacker opens browser developer tools
Execution
Retrieve logged MAC addresses
Impact
Map network topology
Sign in to reveal

Vulnerability AssessmentAI

Exploitation An authenticated administrator must have previously used the 'Copy learned MAC Addresses' function within the web GUI, which generates log entries containing the sensitive MAC address data. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 4.0 score of 5.3 reflects network accessibility (AV:N) with low attack complexity (AC:L), low confidentiality impact (VC:L), and no integrity or availability impact (VI:N/VA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An industrial facility's network administrator uses the Xelity switch web GUI to export and document learned MAC addresses. An attacker on the production network segment accesses the switch's web interface and opens browser developer tools (F12 or right-click inspect). …
Remediation Apply the vendor-released security patch from Murrelektronik for the Xelity switch firmware when available. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-209 – Error Message Information Leak

View all
CVE-2025-47813 MEDIUM POC
4.3
CVE-2017-7551 CRITICAL POC
9.8
CVE-2026-48039 CRITICAL POC
9.1
CVE-2022-31140 CRITICAL POC
9.1
CVE-2024-23689 HIGH POC
8.8
CVE-2018-17961 HIGH POC
8.6
CVE-2023-37306 HIGH POC
7.5
CVE-2026-29146 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-8173 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy