CVE-2026-41020: High severity Eaton easyE4 vulnerability
Published Oct 27, 2026
·Updated
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.
Affected Software
1 affected component
Eaton easyE4
Event History
Oct 27, 2026
CVE Published
via MITRE·11:05 AM
Data Sourced
via MITRE·11:05 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker needs access to captured authentication traffic from the device. They can then replay a valid authentication exchange without authenticating themselves.
2
Is user interaction required for exploitation?
Yes. The supplied vector indicates user interaction is required, although the specific user action is not described.
3
What access could an attacker obtain?
Successful replay of a valid authentication exchange could give the attacker unauthorized access to the device. The vulnerability is rated as having high confidentiality, integrity, and availability impact.