Eaton easyE4 CVE-2026-41020

Exploitation requires the attacker to first capture a valid authentication exchange between a legitimate user and the Eaton easyE4 device - i.e. a network position allowing traffic interception - and then replay it; the replay succeeds specifically because the device reuses a static nonce during authentication rather than a fresh challenge. Limiting factors, consistent with CVSS AC:H and UI:R: a legitimate authentication must actually occur and be observed before any attack is possible, and the attacker needs sniffing access to the control-network traffic path. These conditions make the flaw most realistic on flat or unsegmented OT networks; proper network segmentation and monitoring substantially raise the bar. The vendor fix is available in easyE4 2.46.

Severity signals are moderate-to-high but real-world risk is bounded by access preconditions. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5) reflects an unauthenticated flaw with full confidentiality, integrity, and availability impact, but the AC:H and UI:R metrics capture the key limiter: the attacker must first obtain a captured valid authentication exchange before the static-nonce weakness (CWE-294, authentication-bypass by capture-replay) lets them replay it. No EPSS score, CISA KEV listing, or POC reference is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation probability signals are absent rather than low. The vuln.today decision label is 'this_week', consistent with a patched, vendor-reported OT flaw warranting prompt but not emergency remediation. This is a genuine but conditional priority: credible full-device compromise if auth traffic can be captured on the control network, offset by the need for network capture position and a legitimate authentication to observe. Note the input Tags include a 'Microsoft' tag that does not match this Eaton product and appears mislabeled.

An attacker positioned to sniff traffic on the OT/control network captures a legitimate operator's authentication exchange with an Eaton easyE4 device. Because the device uses a static nonce, the attacker replays the captured exchange to authenticate as that operator and gain unauthorized access to the controller. No public exploit code is identified in the available sources; the attack relies on standard traffic capture and replay rather than a published tool.