---
id: "CVE-2026-41020"
kind: "vulnerability"
aliases: ["CVE-2026-41020"]
title: "Eaton easyE4: static authentication nonce lets captured logins be replayed"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "easyE4 base unit firmware", "fixed": ["2.46"], "affected": "<= 2.45", "ecosystem": "vendor"}, {"name": "easySoft", "fixed": ["8.46"], "affected": "<= 8.45", "ecosystem": "vendor"}]
ecosystems: []
tags: ["easye4", "easysoft", "eaton", "industrial-control", "infrastructure", "mitm", "plc", "power-equipment"]
not_affected_if: ["isolated-network", "no-network-access"]
published_at: "2026-10-27T12:17:07+00:00"
first_seen_at: "2026-10-27T12:31:38+00:00"
updated_at: "2026-10-27T12:32:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41020", "first_seen_at": "2026-10-27T12:31:38+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T12:32:55+00:00"}]
---

# Eaton easyE4: static authentication nonce lets captured logins be replayed

Eaton easyE4 authentication uses a static nonce, so a captured login exchange can be replayed (CVSS 7.5, requires man-in-the-middle position). Fixed in firmware V2.46. Related: CVE-2026-41021 (weak 6-char password policy lets a captured hash be cracked offline) and CVE-2026-41022 (easySoft TLS certificate validation bypass).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:easyE4 base unit firmware affected <= 2.45 fixed 2.46
- vendor:easySoft affected <= 8.45 fixed 8.46

## How to check

Read the firmware version of each easyE4 base unit (device display or easySoft). Firmware 2.45 or earlier is affected; also check easySoft is 8.45 or earlier. Hardware revisions older than 08 cannot be upgraded and stay exposed.

## Fix

Upgrade easyE4 base units (hardware revision 08+) to firmware V2.46 (see its release notes for the procedure) and easySoft to V8.46. Units older than hardware revision 08 cannot be upgraded; use the mitigations.

## Timeline

- 2026-10-27T12:31:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-41020
- 2026-10-27T12:32:55+00:00 analyst — Read Eaton ETN-VA-2026-1017 (10/21/2026): all easyE4 base units fw <=2.45 and easySoft <=8.45 affected; fix fw V2.46 / easySoft V8.46. No exploitation or PoC found; social not searched.

## Documents

- [advisory] ETN-VA-2026-1017: Multiple vulnerabilities patched in Eaton easyE4 devices and easySoft https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-va-2026-1017.pdf

## From the sources

Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_