CVE-2026-6866

HIGH EPSS 20.8%
Published May 12, 20261mo ago · Modified Jun 24, 20261w ago
8.2 CVSS 4.0
High
Find Similar
Published May 12, 2026 1mo ago
Last Modified Jun 24, 2026 1w ago

Description

CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.

CVSS Details

Base Score
8.2
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
20.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-1188

Affected Products 10

VendorProductVersionRange
schneider-electricecostruxure_panel_server_pas400_firmware* <002.006.000
schneider-electricecostruxure_panel_server_pas400*any
schneider-electricecostruxure_panel_server_pas600_firmware* <002.006.000
schneider-electricecostruxure_panel_server_pas600*any
schneider-electricecostruxure_panel_server_pas600v2_firmware* <002.006.000
schneider-electricecostruxure_panel_server_pas600v2*any
schneider-electricecostruxure_panel_server_pas800_firmware* <002.006.000
schneider-electricecostruxure_panel_server_pas800*any
schneider-electricecostruxure_panel_server_pas800v2_firmware* <002.006.000
schneider-electricecostruxure_panel_server_pas800v2*any

References 1

  • download.schneider-electric.com https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-04.pdf
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.