medium
advisory
Eaton easyE4: Authentication replay vulnerability via static nonce (CVE-2026-41020)
Eaton easyE4 uses a static nonce during authentication, allowing an unauthenticated attacker to replay captured authentication traffic to gain unauthorized access to the device.
CVE search metadata
CVE search record: CVE-2026-41020. Severity: high. CVSS: 7.5. KEV: no. Product: easyE4. Brief: Eaton easyE4: Authentication replay vulnerability via static nonce (CVE-2026-41020). Brief link: https://feed.craftedsignal.io/briefs/2026-10-eaton-easye4-static-nonce/
Triage facts
Revision 1- Applicability
- easyE4
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 13:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Eaton easyE4 devices utilize a static nonce during authentication. This allows an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.