Live › vulnerability › CVE-2026-41020
Go to dashboardEaton easyE4 authentication uses a static nonce, so a captured login exchange can be replayed (CVSS 7.5, requires man-in-the-middle position). Fixed in firmware V2.46. Related: CVE-2026-41021 (weak 6-char password policy lets a captured hash be cracked offline) and CVE-2026-41022 (easySoft TLS certificate validation bypass).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 12:31 UTC. All times on this page are UTC.
Operators of Eaton easyE4 devices on their network. The sources do not list affected firmware versions or say which deployments expose the authentication traffic. unknown
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| easyE4 base unit firmware | vendor | <= 2.45 | 2.46 |
| easySoft | vendor | <= 8.45 | 8.46 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.
This page as .md · .json · in your agent: get_signal("CVE-2026-41020")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.