CVE-2026-6866

CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.

Score

CVSS 4.0 8.2 High

Status

Analyzed - cybersecurity@se.com

Published

2026-05-12

Last modified

2026-10-26

Weaknesses

CWE-1188

Affected products

• Ecostruxure Panel Server Pas400 Firmware (Schneider-electric)
• Ecostruxure Panel Server Pas600 Firmware (Schneider-electric)
• Ecostruxure Panel Server Pas600v2 Firmware (Schneider-electric)
• Ecostruxure Panel Server Pas800 Firmware (Schneider-electric)
• Ecostruxure Panel Server Pas800v2 Firmware (Schneider-electric)
• Ecostruxure Panel Server (Schneider Electric)

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-04&p_enDocType=Security+and+Safety+Notice&p_File_…