CISA + leveranciers
ICS Advisories
Advisories specifiek gericht op industriële besturingssystemen — van CISA ICS-CERT en rechtstreeks van leveranciers (onder meer Siemens, ABB, Schneider Electric, WAGO en Phoenix Contact) — inclusief revisiegeschiedenis (initiële publicatie, Update A, Update B) en gekoppelde CVE's.
1
Gevonden
Advisorydata: live koppeling— laatst opgehaald: 7 november 2026 om 13:52.
Filters
1 actief1 advisories gevonden
VDE-2026-061
Murrelektronik: Vulnerability in 'Copy learned MAC Addresses' function enables MAC Spoofing on Xelity Switches
Gepubliceerd
24 augustus 2026
Laatste update
25 augustus 2026
Gekoppelde CVE's
Getroffen sectoren
Risk evaluation
An information disclosure vulnerability in the web GUI of Murrelektronik Xelity switches causes MAC addresses from the device's MAC address table to be written into a server-side log that is exposed via the device's web interface to unauthenticated users. The leak is triggered when an authenticated administrator invokes the 'Copy learned MAC Addresses' function, which causes a syslog error that inserts the affected MAC addresses into the log output. Once the error has been triggered, any unauthenticated attacker with network access to the web interface can retrieve the leaked MAC addresses via common browser developer tools. The vulnerable functionality was introduced in version 2.1.0 and is fixed in version 2.1.1.
Mitigatiesamenvatting
Update the affected Xelity switches to firmware version V2.1.1 or later. This firmware version removes the syslog error that caused the MAC address table contents to be written to a web-accessible log.
Revisiegeschiedenis (2)
Initiële publicatie — 24 augustus 2026
initial release
Update A — 25 augustus 2026
The advisory title was edited. The vendor name was missing from the title.