CVE-2026-8173 PUBLISHED

Information Disclosure via 'Copy learned MAC Addresses' Function

Assigner: CERTVDE
Reserved: 08.05.2026 Published: 24.08.2026 Updated: 24.08.2026

The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools.

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	Low	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	Passive

CVSS 4.0

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Murrelektronik
Product	Xelity 4TX M GE
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 4TX M GE PN
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 6TX M GE
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 6TX M GE PN
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 8TX M GE
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 8TX M GE PN
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity-16TX-M-GE
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity-16TX-M-GE-PN
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 10 TX IP67 M FE 4P
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 10 TX IP67 M FE PN 4P
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 8 +2 TX IP67 M GE 4P
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 8 +2 TX IP67 M GE PN 4P
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 10 TX IP67 M GE 4P
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 10 TX IP67 M GE PN 4P
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 6TX 4PW IP67 M GE PN 4P
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 10 TX IP67 M FE 5P
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 10 TX IP67 M FE PN 5P
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 8 +2 TX IP67 M GE 5P
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 8 +2 TX IP67 M GE PN 5P
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 10 TX IP67 M GE 5P
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 10 TX IP67 M GE PN 5P
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	Xelity 6TX 4PW IP67 M GE PN 5P
Versions	Default: unaffected Version 2.1.0 is affected

Vendor	Murrelektronik
Product	6 TX M GE + 4 Power M12 IP67
Versions	Default: unaffected Version 2.1.0 is affected

References

https://www.certvde.com/en/advisories/VDE-2026-061/

Problem Types

CWE-209 Generation of Error Message Containing Sensitive Information CWE