Medium severity · published Aug 24, 2026
CVE-2026-8173
Information Disclosure via 'Copy learned MAC Addresses' Function
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
6T
6 TX M GE + 4 Power M12 IP67 · Murrelektronik
2.1.0 · source: vendor
X1
Xelity 10 TX IP67 M FE 4P · Murrelektronik
2.1.0 · source: vendor
X1
Xelity 10 TX IP67 M FE 5P · Murrelektronik
2.1.0 · source: vendor
X1
Xelity 10 TX IP67 M FE PN 4P · Murrelektronik
2.1.0 · source: vendor
X1
Xelity 10 TX IP67 M FE PN 5P · Murrelektronik
2.1.0 · source: vendor
X1
Xelity 10 TX IP67 M GE 4P · Murrelektronik
2.1.0 · source: vendor
X1
Xelity 10 TX IP67 M GE 5P · Murrelektronik
2.1.0 · source: vendor
X1
Xelity 10 TX IP67 M GE PN 4P · Murrelektronik
2.1.0 · source: vendor
X1
Xelity 10 TX IP67 M GE PN 5P · Murrelektronik
2.1.0 · source: vendor
X4
Xelity 4TX M GE · Murrelektronik
2.1.0 · source: vendor
X4
Xelity 4TX M GE PN · Murrelektronik
2.1.0 · source: vendor
X6
Xelity 6TX 4PW IP67 M GE PN 4P · Murrelektronik
2.1.0 · source: vendor