Easye4
Monthly
Eaton easyE4 firmware versions below 2.46 ships an insufficiently strong password policy (CWE-521), so an attacker who has already obtained a stored password hash - for example by way of CVE-2026-41020 - can mount an offline password-guessing attack and potentially recover the underlying user credentials. The weakness is not exploitable on its own: the vendor's CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5) reflects the hash-disclosure prerequisite and the dependence on how strong the configured password actually is, and strong, high-entropy passwords resist offline cracking even under the weak policy. No public exploit code has been identified at time of analysis, and the exposure is limited to easyE4 devices that have not been updated to firmware 2.46 or later.
Eaton easyE4 controllers before version 2.46 reuse a static nonce during authentication, allowing an attacker who can capture a legitimate authentication exchange to replay it and gain unauthorized access to the device. The CVSS 3.1 score is 7.5 (AV:N/AC:H/PR:N/UI:R), reflecting that exploitation depends on a real login occurring and being observed on the control-network path; no public exploit code or CISA KEV entry was identified at time of analysis. Eaton has released a fix in easyE4 2.46.
Eaton easyE4 firmware versions below 2.46 ships an insufficiently strong password policy (CWE-521), so an attacker who has already obtained a stored password hash - for example by way of CVE-2026-41020 - can mount an offline password-guessing attack and potentially recover the underlying user credentials. The weakness is not exploitable on its own: the vendor's CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5) reflects the hash-disclosure prerequisite and the dependence on how strong the configured password actually is, and strong, high-entropy passwords resist offline cracking even under the weak policy. No public exploit code has been identified at time of analysis, and the exposure is limited to easyE4 devices that have not been updated to firmware 2.46 or later.
Eaton easyE4 controllers before version 2.46 reuse a static nonce during authentication, allowing an attacker who can capture a legitimate authentication exchange to replay it and gain unauthorized access to the device. The CVSS 3.1 score is 7.5 (AV:N/AC:H/PR:N/UI:R), reflecting that exploitation depends on a real login occurring and being observed on the control-network path; no public exploit code or CISA KEV entry was identified at time of analysis. Eaton has released a fix in easyE4 2.46.