CVE-2026-6866
Analyzed
Analyzed - Analysis Complete
BaseFortify
Vulnerability report for CVE-2026-6866, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-05-12
Last updated on: 2026-06-24
Assigner: Schneider Electric SE
Description
Description
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| schneider-electric | ecostruxure_panel_server_pas400_firmware | to 002.006.000 (exc) |
| schneider-electric | ecostruxure_panel_server_pas600_firmware | to 002.006.000 (exc) |
| schneider-electric | ecostruxure_panel_server_pas600v2_firmware | to 002.006.000 (exc) |
| schneider-electric | ecostruxure_panel_server_pas800_firmware | to 002.006.000 (exc) |
| schneider-electric | ecostruxure_panel_server_pas800v2_firmware | to 002.006.000 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-1188 | The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure. |
