CVE-2026-6866

HIGH

Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server

Title source: cna
STIX 2.1

Description

CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.

References (1)

Core 1

Scores

CVSS v3 7.5
EPSS 0.0029
EPSS Percentile 21.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-1188
Status published
Products (6)
Schneider Electric/EcoStruxure™ Panel Server Versions 002.005.000 and prior
schneider-electric/ecostruxure_panel_server_pas400_firmware < 002.006.000
schneider-electric/ecostruxure_panel_server_pas600_firmware < 002.006.000
schneider-electric/ecostruxure_panel_server_pas600v2_firmware < 002.006.000
schneider-electric/ecostruxure_panel_server_pas800_firmware < 002.006.000
schneider-electric/ecostruxure_panel_server_pas800v2_firmware < 002.006.000
Published May 12, 2026
Tracked Since May 12, 2026