{"id":"CVE-2026-41022","kind":"vulnerability","aliases":["CVE-2026-41022"],"related":[],"title":"Eaton easySoft accepts unverified TLS certificates from easyE4 devices","description":"Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4.","summary":"Eaton easySoft does not properly check the TLS certificates presented by easyE4 devices. A network attacker in the path can impersonate an easyE4 device and read or change traffic between the two.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["easye4","easysoft","eaton","ics","infrastructure","on-prem","power-management"],"not_affected_if":["isolated-management-network","no-easye4","no-easysoft"],"how_to_check":"- Check the installed easySoft version in the application's About or help menu, or on the host's installed programs list.\n- Confirm whether easySoft connects to easyE4 devices over TLS on the local network: `unknown` if the sources do not say which versions are affected.","fix":"- Update easySoft to the vendor-fixed version: `unknown` (the sources do not name it).\n- Check the Eaton security advisory for the fixed release and certificate-handling guidance: `unknown`.","status":"open","published_at":"2026-10-27T12:17:07+00:00","first_seen_at":"2026-10-27T12:31:38+00:00","triaged_at":"2026-10-27T12:32:11+00:00","updated_at":"2026-10-27T12:32:11+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T12:32:11Z","model":"claude-haiku-5-5","output":{"fix":"- Update easySoft to the vendor-fixed version: `unknown` (the sources do not name it).\n- Check the Eaton security advisory for the fixed release and certificate-handling guidance: `unknown`.","reach":"network","title":"Eaton easySoft accepts unverified TLS certificates from easyE4 devices","impact":"medium","summary":"Eaton easySoft does not properly check the TLS certificates presented by easyE4 devices. A network attacker in the path can impersonate an easyE4 device and read or change traffic between the two.","category":"infrastructure","nicknames":[],"who_cares":["eaton","easysoft","easye4","ics","power-management","on-prem"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker intercepts and modifies easySoft to easyE4 traffic","analyst_note":"Find the NVD or Eaton advisory for affected and fixed easySoft versions, and whether the flaw needs a specific connection mode.","how_to_check":"- Check the installed easySoft version in the application's About or help menu, or on the host's installed programs list.\n- Confirm whether easySoft connects to easyE4 devices over TLS on the local network: `unknown` if the sources do not say which versions are affected.","needs_analyst":true,"not_affected_if":["no-easysoft","no-easye4","isolated-management-network"],"who_is_affected":"Sites that use Eaton easySoft to manage easyE4 power devices over a TLS connection are exposed. An attacker on the same network segment as the management traffic is the realistic threat, so systems where easySoft and easyE4 devices share an isolated management VLAN carry less risk. Teams that do not run easySoft or easyE4 can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000648,"input_tokens":3294,"output_tokens":637,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-41022':12A,15A 'accept':3A 'adjac':72C 'attack':42B,73C,86C 'certif':6A,35B,64C 'chang':54B 'check':32B 'communic':92C 'could':74C 'cve':10A,13A 'devic':9A,39B,50B,68C 'easye4':8A,16B,38B,49B,67C,96C 'easysoft':2A,17B,28B,60C,94C 'eaton':1A,18B,27B,59C 'exploit':75C 'ic':19B 'imperson':47B 'improp':61C 'infrastructur':20B 'intercept':89C 'man':82C 'man-in-the-middl':81C 'manag':26B 'middl':85C 'modifi':91C 'network':41B,71C 'network-adjac':70C 'on-prem':21B 'path':45B 'perform':79C 'potenti':88C 'power':25B 'power-manag':24B 'prem':23B 'present':36B,65C 'proper':31B 'read':52B 'tls':5A,34B,63C 'traffic':55B 'two':58B 'unverifi':4A 'valid':62C 'weak':77C","nicknames":[],"mitigations":[],"who_affected":"Sites that use Eaton easySoft to manage easyE4 power devices over a TLS connection are exposed. An attacker on the same network segment as the management traffic is the realistic threat, so systems where easySoft and easyE4 devices share an isolated management VLAN carry less risk. Teams that do not run easySoft or easyE4 can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T12:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","cvss_by":"CybersecurityCOE@eaton.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-41022","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41022","severity":null,"published_at":"2026-10-27T12:17:07+00:00","modified_at":"2026-10-27T12:17:07+00:00","first_seen_at":"2026-10-27T12:31:38+00:00","fetched_at":"2026-10-27T12:31:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}