CVE-2026-41022: Medium severity Eaton EASYsoft vulnerability
Published Oct 27, 2026
·Updated
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4.
Affected Software
1 affected component
Eaton EASYsoft
Event History
Oct 27, 2026
CVE Published
via MITRE·11:32 AM
Data Sourced
via MITRE·11:32 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What conditions must an attacker meet to exploit this issue?
The attacker must be network-adjacent and able to position themselves between easySoft and an easyE4 device. Successful exploitation also requires a user to interact with the affected communication path.
2
What could an attacker do if exploitation succeeds?
An attacker could conduct a man-in-the-middle attack on communications between easySoft and easyE4. This could allow interception or modification of those communications, with potential effects on confidentiality, integrity, and availability.