CVE-2026-8173
Information Disclosure via 'Copy learned MAC Addresses' Function
The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Information Disclosure via 'Copy learned MAC Addresses' Function
The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools.
- Record
CVE-2026-8173- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
EUVDEUVD-2026-64744
The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools.
- Record
EUVD-2026-64744- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f42v-6cfh-6pj5
The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC...
The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools.
- Record
GHSA-f42v-6cfh-6pj5- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
NVD
The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools.
- Record
CVE-2026-8173- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
Affected products
- murrelektronik 6 tx m ge + 4 power m12 ip67
- murrelektronik xelity 10 tx ip67 m fe 4p
- murrelektronik xelity 10 tx ip67 m fe 5p
- murrelektronik xelity 10 tx ip67 m fe pn 4p
- murrelektronik xelity 10 tx ip67 m fe pn 5p
- murrelektronik xelity 10 tx ip67 m ge 4p
- murrelektronik xelity 10 tx ip67 m ge 5p
- murrelektronik xelity 10 tx ip67 m ge pn 4p
- murrelektronik xelity 10 tx ip67 m ge pn 5p
- murrelektronik xelity 4tx m ge
- murrelektronik xelity 4tx m ge pn
- murrelektronik xelity 6tx 4pw ip67 m ge pn 4p
Show 11 moreShow less
- murrelektronik xelity 6tx 4pw ip67 m ge pn 5p
- murrelektronik xelity 6tx m ge
- murrelektronik xelity 6tx m ge pn
- murrelektronik xelity 8 +2 tx ip67 m ge 4p
- murrelektronik xelity 8 +2 tx ip67 m ge 5p
- murrelektronik xelity 8 +2 tx ip67 m ge pn 4p
- murrelektronik xelity 8 +2 tx ip67 m ge pn 5p
- murrelektronik xelity 8tx m ge
- murrelektronik xelity 8tx m ge pn
- murrelektronik xelity-16tx-m-ge
- murrelektronik xelity-16tx-m-ge-pn
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-8173 is a medium vulnerability (CVSS 5.3) in Murrelektronik 6 Tx M Ge + 4 Power M12 Ip67, published August 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. No source names a fixed version.