CVE-2026-41021

HighCVSS 7.5

Published: 27/10/2026(UTC)Updated: 27/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials.

Risk Assessment

Could lead to credential recovery and unauthorized device access. Risk increases when combined with other vulnerabilities leaking hashes.

Recommendation

Enforce a stronger password policy and require password changes. Update the firmware if the vendor provides a fix.

Other vulnerabilities in Eaton easyE4

CVE-2026-41020High
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS