Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server (Schneider Electric EcoStruxure™ Panel Server)
En bref
- Source
- NVD
- EPSS
- EPSS 0.29 % · centile 22 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- schneider
- Statut NVD
- Analyzed
Rechercher sur…
Description
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.
Faiblesses (CWE)
- CWE-1188 — Initialisation par défaut non sécurisée d'une ressource
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | HIGH 8.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | schneider |
| CVSS 4.0 | HIGH 8.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · cybersecurity@se.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2026-29484
- GCVE · GCVE-0-2026-6866
Avis du CERT-FR
- CERTFR-2026-AVI-0566 — Multiples vulnérabilités dans les produits Schneider Electric · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas400_firmware:*:*:*:*:*:*:*:*< 002.006.000cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas600_firmware:*:*:*:*:*:*:*:*< 002.006.000cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas600v2_firmware:*:*:*:*:*:*:*:*< 002.006.000cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas800_firmware:*:*:*:*:*:*:*:*< 002.006.000cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas800v2_firmware:*:*:*:*:*:*:*:*< 002.006.000
Produits affectés
| Produit | Versions |
|---|---|
| Schneider Electric · EcoStruxure™ Panel Server | affected Versions 002.005.000 and prior |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |