CISA + Hersteller
ICS-Advisories
Advisories speziell für industrielle Steuerungssysteme — von CISA ICS-CERT und direkt von Herstellern (darunter Siemens, ABB, Schneider Electric, WAGO und Phoenix Contact) — einschließlich Revisionshistorie (Erstveröffentlichung, Update A, Update B) und verknüpfter CVEs.
1
Gefunden
Advisory-Daten: Live-Anbindung— zuletzt abgerufen: 7. November 2026 um 14:22.
Filter
1 aktiv1 Advisories gefunden
VDE-2026-061
Murrelektronik: Vulnerability in 'Copy learned MAC Addresses' function enables MAC Spoofing on Xelity Switches
Veröffentlicht
24. August 2026
Letzte Aktualisierung
25. August 2026
Verknüpfte CVEs
Betroffene Sektoren
Risk Evaluation
An information disclosure vulnerability in the web GUI of Murrelektronik Xelity switches causes MAC addresses from the device's MAC address table to be written into a server-side log that is exposed via the device's web interface to unauthenticated users. The leak is triggered when an authenticated administrator invokes the 'Copy learned MAC Addresses' function, which causes a syslog error that inserts the affected MAC addresses into the log output. Once the error has been triggered, any unauthenticated attacker with network access to the web interface can retrieve the leaked MAC addresses via common browser developer tools. The vulnerable functionality was introduced in version 2.1.0 and is fixed in version 2.1.1.
Zusammenfassung der Gegenmaßnahmen
Update the affected Xelity switches to firmware version V2.1.1 or later. This firmware version removes the syslog error that caused the MAC address table contents to be written to a web-accessible log.
Revisionshistorie (2)
Erstveröffentlichung — 24. August 2026
initial release
Update A — 25. August 2026
The advisory title was edited. The vendor name was missing from the title.