Improper Message Generation in Murrelektronik Xelity Switches Exposes Sensitive Data
CVE-2026-8173

5.3MEDIUM

Key Information:

Vendor

Murrelektronik

Status
Xelity 4tx M Ge
Xelity 4tx M Ge Pn
Xelity 6tx M Ge
Xelity 6tx M Ge Pn
Vendor
CVE Published:
24 August 2026

What is CVE-2026-8173?

The web GUI of Murrelektronik Xelity switches presents a security risk due to improper handling of error messages. When an authenticated administrator uses the 'Copy learned MAC Addresses' function, the system logs the MAC addresses from the devices' MAC address table. An unauthenticated attacker, with access to the network and the web interface, can exploit this flaw to retrieve sensitive logged MAC addresses through browser developer tools, compromising the security and privacy of the network.

Affected Version(s)

6 TX M GE + 4 Power M12 IP67 2.1.0

Xelity 10 TX IP67 M FE 4P 2.1.0

Xelity 10 TX IP67 M FE 5P 2.1.0

References

https://www.certvde.com/en/advisories/VDE-2026-061/

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.