CVE-2026-6866 HIGH

Published: 2026-05-12 | Last Modified: 2026-06-24 | Status: Analyzed

Description

CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	NONE
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 8.2 (HIGH)

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector	NETWORK
Attack Complexity	LOW
Attack Requirements	PRESENT
Privileges Required	NONE
User Interaction	NONE
Vulnerability Confidentiality	HIGH
Vulnerability Integrity	NONE
Vulnerability Availability	NONE
Subsequent Confidentiality	NONE
Subsequent Integrity	NONE
Subsequent Availability	NONE

Source: [email protected]

Type: Secondary

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-1188

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	ecostruxure_panel_server_pas400_firmware	*	<built-in method update of dict object at 0x7e6111fee5c0>	Operating System
schneider-electric	ecostruxure_panel_server_pas600_firmware	*	<built-in method update of dict object at 0x7e60e8c7dcc0>	Operating System
schneider-electric	ecostruxure_panel_server_pas600v2_firmware	*	<built-in method update of dict object at 0x7e60a87b5e40>	Operating System
schneider-electric	ecostruxure_panel_server_pas800_firmware	*	<built-in method update of dict object at 0x7e61079c9080>	Operating System
schneider-electric	ecostruxure_panel_server_pas800v2_firmware	*	<built-in method update of dict object at 0x7e6111fee100>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas400_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:ecostruxure_panel_server_pas400:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas600_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:ecostruxure_panel_server_pas600:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas600v2_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:ecostruxure_panel_server_pas600v2:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas800_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:ecostruxure_panel_server_pas800:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas800v2_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:ecostruxure_panel_server_pas800v2:-:::::::*`

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-04.pdf
Source: [email protected]

Vendor Advisory