CVE-2026-8173 Overview
CVE-2026-8173 affects Murrelektronik Xelity industrial Ethernet switches. The web GUI logs MAC addresses from the device's MAC address table when an authenticated administrator invokes the Copy learned MAC Addresses function. Improper generation of error messages exposes this logged data. An unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools. The flaw is categorized under CWE-209 (Information Exposure Through Error Message). Exploitation reveals only network topology information, not credentials or configuration data.
Critical Impact
Unauthenticated network-adjacent attackers can enumerate learned MAC addresses from Xelity switches, exposing connected device inventory and aiding lateral movement reconnaissance.
Affected Products
- Murrelektronik Xelity switches (see CERT VDE Advisory VDE-2026-061 for affected models and versions)
Discovery Timeline
- 2026-08-24 - CVE-2026-8173 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-8173
Vulnerability Analysis
The vulnerability resides in the web management interface of Murrelektronik Xelity switches. When an authenticated administrator uses the Copy learned MAC Addresses function, the web GUI writes MAC address table contents into diagnostic output. Improperly generated error responses persist this data in a location retrievable through browser developer tools. Because the retrieval path does not enforce authentication, any actor with network reachability to the web interface can inspect the exposed data.
The exposed MAC addresses reveal downstream endpoints, industrial controllers, and other network participants attached to the switch. Adversaries performing reconnaissance against operational technology (OT) environments can use this data to map network topology, identify hardware vendors from OUI prefixes, and prioritize follow-on targets.
Root Cause
The root cause is improper generation of error messages (CWE-209). Diagnostic error output includes sensitive runtime data from the switch's forwarding tables. The interface fails to scrub or authenticate access to this data before it becomes observable to unauthenticated clients.
Attack Vector
Exploitation requires network access to the switch's web interface and user interaction from an administrator who triggers the Copy learned MAC Addresses function. Once the function executes, an attacker inspects HTTP responses or DOM state using browser developer tools to extract the logged MAC addresses. No credentials are required for the retrieval step.
No public proof-of-concept code is available. Refer to CERT VDE Advisory VDE-2026-061 for vendor-provided technical details.
Detection Methods for CVE-2026-8173
Indicators of Compromise
- Unexpected HTTP GET requests to the Xelity switch web GUI from unauthenticated sources following administrative activity
- Web server access logs showing repeated retrieval of diagnostic or error resources by non-administrator clients
- Anomalous traffic to switch management interfaces originating outside the OT management VLAN
Detection Strategies
- Monitor HTTP responses from switch management interfaces for MAC address table content in error payloads
- Alert on access to the web GUI from source addresses not present in an approved management allowlist
- Correlate administrator sessions invoking Copy learned MAC Addresses with subsequent unauthenticated requests to the same interface
Monitoring Recommendations
- Forward web GUI access logs from Xelity switches to a centralized SIEM for baseline and anomaly analysis
- Track network flows to TCP management ports on industrial switches and flag connections from non-engineering workstations
- Review MAC address table exports and administrator UI activity on a scheduled cadence
How to Mitigate CVE-2026-8173
Immediate Actions Required
- Restrict access to the Xelity web management interface to a dedicated management VLAN or jump host
- Advise administrators to avoid using the Copy learned MAC Addresses function until a patched firmware is deployed
- Apply firmware updates as published in CERT VDE Advisory VDE-2026-061
Patch Information
Murrelektronik has coordinated disclosure through CERT@VDE. Consult CERT VDE Advisory VDE-2026-061 for the list of fixed firmware versions and upgrade instructions for affected Xelity switch models.
Workarounds
- Place switch management interfaces behind a firewall that permits only authorized engineering hosts
- Disable the web GUI where command-line or out-of-band management is available
- Enforce network segmentation between OT management and general enterprise networks to limit reconnaissance exposure
# Example ACL restricting web GUI access to a management subnet
ip access-list extended XELITY-MGMT
permit tcp 10.10.50.0 0.0.0.255 host 10.20.0.10 eq 443
deny tcp any host 10.20.0.10 eq 443
permit ip any any
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
