Description
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.
Affected products
schneider-electric: ecostruxure panel server pas400 firmware; schneider-electric: ecostruxure panel server pas400; schneider-electric: ecostruxure panel server pas600 firmware; schneider-electric: ecostruxure panel server pas600; schneider-electric: ecostruxure panel server pas600v2 firmware; schneider-electric: ecostruxure panel server pas600v2; schneider-electric: ecostruxure panel server pas800 firmware; schneider-electric: ecostruxure panel server pas800; schneider-electric: ecostruxure panel server pas800v2 firmware; schneider-electric: ecostruxure panel server pas800v2
References1
- download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-0… Vendor Advisory
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 4.0
-
8.2
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 22 · as of 14 November 2026
- CWE
- CWE-1188
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.