Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server (Schneider Electric EcoStruxure™ Panel Server)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.29 % · percentile 22 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- schneider
- NVD status
- Analyzed
Description
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.
Weaknesses (CWE)
- CWE-1188 — Initialization of a Resource with an Insecure Default
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | HIGH 8.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | schneider |
| CVSS 4.0 | HIGH 8.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · cybersecurity@se.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-29484
- GCVE · GCVE-0-2026-6866
CERT-FR advisories
- CERTFR-2026-AVI-0566 — Multiples vulnérabilités dans les produits Schneider Electric · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas400_firmware:*:*:*:*:*:*:*:*< 002.006.000cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas600_firmware:*:*:*:*:*:*:*:*< 002.006.000cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas600v2_firmware:*:*:*:*:*:*:*:*< 002.006.000cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas800_firmware:*:*:*:*:*:*:*:*< 002.006.000cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas800v2_firmware:*:*:*:*:*:*:*:*< 002.006.000
Affected products
| Product | Versions |
|---|---|
| Schneider Electric · EcoStruxure™ Panel Server | affected Versions 002.005.000 and prior |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |