CVE-2023-43776: Weak encoding vulnerability in easyE4

Severity: medium (CVSS 6.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-17 · updated 2026-06-17
Weakness: CWE-261

Description

Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending).

Affected products

Eaton Easy-Box-E4-Ac1 Firmware: before 2.02 — fixed in 2.02
Eaton Easy-Box-E4-Dc1 Firmware: before 2.02 — fixed in 2.02
Eaton Easy-Box-E4-Uc1 Firmware: before 2.02 — fixed in 2.02
Eaton Easy-E4-Ac-12Rc1P Firmware: before 2.02 — fixed in 2.02
Eaton Easy-E4-Ac-12Rcx1P Firmware: before 2.02 — fixed in 2.02
Eaton Easy-E4-Ac-16Re1P Firmware: before 2.02 — fixed in 2.02
Eaton Easy-E4-Dc-12Tc1P Firmware: before 2.02 — fixed in 2.02
Eaton Easy-E4-Dc-12Tcx1P Firmware: before 2.02 — fixed in 2.02
Eaton Easy-E4-Dc-16Te1P Firmware: before 2.02 — fixed in 2.02
Eaton Easy-E4-Dc-4Pe1P Firmware: before 2.02 — fixed in 2.02
Eaton Easy-E4-Dc-6Ae1P Firmware: before 2.02 — fixed in 2.02
Eaton Easy-E4-Dc-8Te1P Firmware: before 2.02 — fixed in 2.02
Eaton Easy-E4-Uc-12Rc1P Firmware: before 2.02 — fixed in 2.02
Eaton Easy-E4-Uc-12Rcx1P Firmware: before 2.02 — fixed in 2.02
Eaton Easy-E4-Uc-16Re1 Firmware: before 2.02 — fixed in 2.02
Eaton Easy-E4-Uc-16Re1P Firmware: before 2.02 — fixed in 2.02
Eaton Easy-E4-Uc-8Re1P Firmware: before 2.02 — fixed in 2.02
Eaton Easy E4-Ac-8Re1P Firmware: before 2.02 — fixed in 2.02
Eaton Xv-102-A035Tqrb-1E4 Firmware: before 2.02 — fixed in 2.02
Eaton Xv-102-A3-57Tvrb-1E4 Firmware: before 2.02 — fixed in 2.02
Eaton Xv100-Box-E4-Dc1 Firmware: before 2.02 — fixed in 2.02
Eaton Xv100-Box-E4-Uc1 Firmware: before 2.02 — fixed in 2.02

How to fix

Upgrade to a fixed version: Eaton Easy-Box-E4-Ac1 Firmware 2.02; Eaton Easy-Box-E4-Dc1 Firmware 2.02; Eaton Easy-Box-E4-Uc1 Firmware 2.02; Eaton Easy-E4-Ac-12Rc1P Firmware 2.02; Eaton Easy-E4-Ac-12Rcx1P Firmware 2.02; Eaton Easy-E4-Ac-16Re1P Firmware 2.02; Eaton Easy-E4-Dc-12Tc1P Firmware 2.02; Eaton Easy-E4-Dc-12Tcx1P Firmware 2.02; Eaton Easy-E4-Dc-16Te1P Firmware 2.02; Eaton Easy-E4-Dc-4Pe1P Firmware 2.02; Eaton Easy-E4-Dc-6Ae1P Firmware 2.02; Eaton Easy-E4-Dc-8Te1P Firmware 2.02. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-43776 or the next vulnerability affects your stack