Eaton easyE4 CVE-2026-41021

Exploitation is not standalone: the attacker must FIRST obtain a stored easyE4 password hash - the description names CVE-2026-41020 as one means of doing so. Only then can the weak-password-policy weakness be leveraged via an OFFLINE guessing/brute-force attack against that hash. Success is further limited by the actual strength of the configured user password (strong, high-entropy passwords resist offline cracking even with this weak policy), and the CVSS vector's AC:H and UI:R reflect these preconditions. The affected scope is Eaton easyE4 firmware versions below 2.46; updating to 2.46 or later is the vendor-provided fix.

This is a weak-password-policy weakness (CWE-521) rated CVSS 7.5 by the vendor, with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The high C/I/A impact reflects the consequence of recovering valid user credentials, not an independently exploitable network flaw: the description makes clear the attack is an OFFLINE password-guessing attack that first requires the attacker to obtain a password hash, explicitly citing CVE-2026-41020 as one way to do so. The signals are mostly moderate rather than emergency: there is no CISA KEV listing and no EPSS score in the provided data, and no public exploit or PoC reference is included. The vuln.today decision label is 'this_week', indicating a prompt-but-not-emergency priority, consistent with a patch being available. The CVSS attack complexity is High (AC:H) and user interaction is Required (UI:R), which aligns with the real-world precondition that the attacker must first acquire a hash before any offline cracking is possible - so the AV:N network vector overstates how directly this can be triggered on its own. In short, this is a meaningful contributing weakness that becomes dangerous when chained with a hash-disclosure flaw, rather than a standalone widely-exploitable network vulnerability; prioritize patching this week alongside CVE-2026-41020.

An attacker first obtains a stored password hash from an Eaton easyE4 device, for example by exploiting CVE-2026-41020, then runs an offline dictionary or brute-force attack against the hash. Because the device enforces an insufficiently strong password policy, weak or short passwords can be recovered, after which the attacker authenticates with the recovered credentials. No public exploit or PoC for this specific issue is identified in the available data.