{"id":"CVE-2026-41020","kind":"vulnerability","aliases":["CVE-2026-41020"],"related":[],"title":"Eaton easyE4: static authentication nonce lets captured logins be replayed","description":"Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.","summary":"Eaton easyE4 authentication uses a static nonce, so a captured login exchange can be replayed (CVSS 7.5, requires man-in-the-middle position). Fixed in firmware V2.46. Related: CVE-2026-41021 (weak 6-char password policy lets a captured hash be cracked offline) and CVE-2026-41022 (easySoft TLS certificate validation bypass).","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"easyE4 base unit firmware","fixed":["2.46"],"affected":"<= 2.45","ecosystem":"vendor"},{"name":"easySoft","fixed":["8.46"],"affected":"<= 8.45","ecosystem":"vendor"}],"ecosystems":[],"tags":["easye4","easysoft","eaton","industrial-control","infrastructure","mitm","plc","power-equipment"],"not_affected_if":["isolated-network","no-network-access"],"how_to_check":"Read the firmware version of each easyE4 base unit (device display or easySoft). Firmware 2.45 or earlier is affected; also check easySoft is 8.45 or earlier. Hardware revisions older than 08 cannot be upgraded and stay exposed.","fix":"Upgrade easyE4 base units (hardware revision 08+) to firmware V2.46 (see its release notes for the procedure) and easySoft to V8.46. Units older than hardware revision 08 cannot be upgraded; use the mitigations.","status":"open","published_at":"2026-10-27T12:17:07+00:00","first_seen_at":"2026-10-27T12:31:38+00:00","triaged_at":"2026-10-27T12:32:02+00:00","updated_at":"2026-10-27T12:32:55+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-27T12:32:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Eaton easyE4: static authentication nonce lets captured logins be replayed","impact":"high","summary":"The Eaton easyE4 device reuses a static nonce during authentication. An attacker who captures authentication traffic can replay a valid exchange and gain unauthorized access to the device.","category":"infrastructure","nicknames":[],"who_cares":["eaton","easye4","industrial-control","power-equipment"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker replays captured login and gains unauthorized device access","analyst_note":"Find the Eaton advisory for easyE4 affected firmware versions and the fixed version, and any mitigation for the static nonce, via the NVD entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Operators of Eaton easyE4 devices on their network. The sources do not list affected firmware versions or say which deployments expose the authentication traffic. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000524,"input_tokens":3289,"output_tokens":391,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Eaton advisory for easyE4 affected firmware versions and the fixed version, and any mitigation for the static nonce, via the NVD entry.","search":"'-2026':12A,15A,64B,80B '-41020':13A,16A '-41021':65B '-41022':81B '6':67B '7.5':50B 'access':102C,116C 'allow':97C 'attack':100C 'authent':4A,36B,94C,105C,111C 'base':18A 'bypass':86B 'captur':7A,43B,73B,104C 'certif':84B 'char':68B 'control':27B 'could':96C 'crack':76B 'cve':11A,14A,63B,79B 'cvss':49B 'devic':119C 'easye4':2A,17A,22B,35B,88C 'easysoft':21A,23B,82B 'eaton':1A,24B,34B,87C 'equip':33B 'exchang':45B,112C 'firmwar':60B 'firmware':20A 'fix':58B 'gain':114C 'hash':74B 'industri':26B 'industrial-control':25B 'infrastructur':28B 'let':6A,71B 'login':8A,44B 'man':53B 'man-in-the-middl':52B 'middl':56B 'mitm':29B 'nonc':5A,40B,92C 'offlin':77B 'password':69B 'plc':30B 'polici':70B 'posit':57B 'power':32B 'power-equip':31B 'relat':62B 'replay':10A,48B,108C 'requir':51B 'static':3A,39B,91C 'tls':83B 'traffic':106C 'unauthent':99C 'unauthor':115C 'unit':19A 'use':37B,89C 'v2.46':61B 'valid':85B,110C 'weak':66B","nicknames":[],"mitigations":[],"who_affected":"Operators of Eaton easyE4 devices on their network. The sources do not list affected firmware versions or say which deployments expose the authentication traffic. unknown","tier":"B","verified":{"fix":{"at":"2026-10-27T12:32:55Z","by":"analyst","run_id":872},"products":{"at":"2026-10-27T12:32:55Z","by":"analyst","run_id":872},"mitigations":{"at":"2026-10-27T12:32:55Z","by":"analyst","run_id":872},"workarounds":{"at":"2026-10-27T12:32:55Z","by":"analyst","run_id":872},"how_to_check":{"at":"2026-10-27T12:32:55Z","by":"analyst","run_id":872},"who_affected":{"at":"2026-10-27T12:32:55Z","by":"analyst","run_id":872}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T12:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"CybersecurityCOE@eaton.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-41020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41020","severity":null,"published_at":"2026-10-27T12:17:07+00:00","modified_at":"2026-10-27T12:17:07+00:00","first_seen_at":"2026-10-27T12:31:38+00:00","fetched_at":"2026-10-27T12:31:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-41020:872","url":null,"severity":null,"published_at":"2026-10-27T12:32:55+00:00","modified_at":"2026-10-27T12:32:55+00:00","first_seen_at":"2026-10-27T12:32:55+00:00","fetched_at":"2026-10-27T12:32:55+00:00","note":"Read Eaton ETN-VA-2026-1017 (10/21/2026): all easyE4 base units fw <=2.45 and easySoft <=8.45 affected; fix fw V2.46 / easySoft V8.46. No exploitation or PoC found; social not searched."}],"documents":[{"id":6301,"url":"https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-va-2026-1017.pdf","title":"ETN-VA-2026-1017: Multiple vulnerabilities patched in Eaton easyE4 devices and easySoft","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}