CVE-2026-6866
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.29%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.
- CVSS 4.0
- 8.2 HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.29% probability · 22th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1188
- Affected
- schneider-electric/ecostruxure panel server pas400 firmware · schneider-electric/ecostruxure panel server pas600 firmware · schneider-electric/ecostruxure panel server pas600v2 firmware · schneider-electric/ecostruxure panel server pas800 firmware · schneider-electric/ecostruxure panel server pas800v2 firmware
- Source
- cybersecurity@se.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.