vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2023-43776

Weak encoding vulnerability in easyE4

MEDIUM
6.6
CVSS Score
Published: October 17, 2023 at 12:35 PM UTC
Updated: June 17, 2026 at 06:26 AM UTC
45 products affected across 1 vendorEasy Box E4-ac1 FirmwareEasy E4-ac 8RE1P FirmwareEasy E4-dc 12TCX1P Firmware

Using easyE4 by Eaton?

Get instant alerts when new vulnerabilities affect easyE4 - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.6
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending).

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Easy Box E4-ac1 Firmware· Eaton
95%
v < 2.02
Affected range stops below 2.02, so it looks safe — our inference, not a vendor statement
eaton-easy-box-e4-ac1 (same device)
Easy Box E4-dc1 Firmware· Eaton
95%
v < 2.02
Affected range stops below 2.02, so it looks safe — our inference, not a vendor statement
eaton-easy-box-e4-dc1 (same device)
Easy Box E4-uc1 Firmware· Eaton
95%
v < 2.02
Affected range stops below 2.02, so it looks safe — our inference, not a vendor statement
eaton-easy-box-e4-uc1 (same device)
Easy E4-ac 12RC1P Firmware· Eaton
95%
v < 2.02
Affected range stops below 2.02, so it looks safe — our inference, not a vendor statement
eaton-easy-e4-ac-12rc1p (same device)
Easy E4-ac 12RCX1P Firmware· Eaton
95%
v < 2.02
Affected range stops below 2.02, so it looks safe — our inference, not a vendor statement
eaton-easy-e4-ac-12rcx1p (same device)
Easy E4-ac 16RE1P Firmware· Eaton
95%
v < 2.02
Affected range stops below 2.02, so it looks safe — our inference, not a vendor statement
eaton-easy-e4-ac-16re1p (same device)
Easy E4-ac 8RE1P Firmware· Eaton
95%
v < 2.02
Affected range stops below 2.02, so it looks safe — our inference, not a vendor statement
eaton-easy-e4-ac-8re1p (same device)
Easy E4-dc 12TC1P Firmware· Eaton
95%
v < 2.02
Affected range stops below 2.02, so it looks safe — our inference, not a vendor statement
eaton-easy-e4-dc-12tc1p (same device)
Easy E4-dc 12TCX1P Firmware· Eaton
95%
v < 2.02
Affected range stops below 2.02, so it looks safe — our inference, not a vendor statement
eaton-easy-e4-dc-12tcx1p (same device)
Easy E4-dc 16TE1P Firmware· Eaton
95%
v < 2.02
Affected range stops below 2.02, so it looks safe — our inference, not a vendor statement
eaton-easy-e4-dc-16te1p (same device)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (1)

MitigationVendor Advisory
Source: [email protected]
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2023-1010.pdf

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.6MEDIUM[email protected]
Attack Vector
PHYSICAL
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-261CWE-326

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card