CVE-2026-8173: CWE-209 Generation of Error Message Containing Sensitive Information in Murrelektronik Xelity 4TX M GE

The vulnerability CVE-2026-8173 affects Murrelektronik Xelity 4TX M GE switches version 2.1.0. The web GUI logs MAC addresses from the device's MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper error message generation (CWE-209), an unauthenticated attacker with network access to the web interface can extract these logged MAC addresses by inspecting the browser developer tools. The CVSS 4.0 base score is 5.3, reflecting a medium severity with network attack vector, no privileges required, and no user interaction needed.

An unauthenticated attacker with network access to the switch's web interface can obtain sensitive MAC address information from the device's MAC address table. This information disclosure could aid in network reconnaissance or further attacks but does not directly allow system compromise or denial of service.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the web interface to trusted administrators only and monitor for unauthorized access attempts.