Eaton fixes three easyE4 and easySoft flaws with firmware 2.46

Eaton published a security advisory on October 21 covering three vulnerabilities in its easyE4 Control device and easySoft management software, and released easyE4 firmware 2.46 and easySoft 8.46 to fix them, according to dailysecu.com. The advisory is tracked as ETN-VA-2026-1017.

CVE-2026-41020 involves fixed random values in the authentication process that allow replay attacks, and is rated CVSS 7.5. CVE-2026-41021 concerns a weak password policy limited to six-character passwords using uppercase letters and digits, also rated 7.5.

The third flaw, CVE-2026-41022, is in easySoft, which fails to properly validate the device's digital certificate, and is rated 5.9. On October 27, the three CVEs were registered in public vulnerability information.

Affected versions and limits

All easyE4 base units running firmware 2.45 or earlier and easySoft versions 8.45 or earlier are affected. Eaton recommends updating to firmware 2.46 and easySoft 8.46, though easyE4 units with a hardware revision older than 08 cannot install the latest firmware.

Eaton's Korean website presents easyE4 as a controller for industry, machine building and building automation with Ethernet, a built-in web server and Modbus TCP support. easyE4 products are listed for sale on Mouser Electronics' and TME's Korean sites, including EASY-E4-AC-12RC1 and EASY-E4-UC-12RC1.