CVE-2023-43776
Medium
Description
Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending).
SeverityMedium
CVSS6.8
Exploit probability—
ProductEaton Easy E4-ac-8re1p Firmware
PublishedOct 17, 2023
First seenOct 17, 2023
Weakness typeCWE-261CWE-261
How to fix
Update
- eaton easy_e4-ac-8re1p_firmware2.02 or later
- eaton easy-box-e4-ac1_firmware2.02 or later
- eaton easy-box-e4-dc1_firmware2.02 or later
- eaton easy-box-e4-uc1_firmware2.02 or later
- eaton easy-e4-ac-12rc1p_firmware2.02 or later
- eaton easy-e4-ac-12rcx1p_firmware2.02 or later
- eaton easy-e4-ac-16re1p_firmware2.02 or later
- eaton easy-e4-dc-12tc1p_firmware2.02 or later
- eaton easy-e4-dc-12tcx1p_firmware2.02 or later
- eaton easy-e4-dc-16te1p_firmware2.02 or later
- eaton easy-e4-dc-4pe1p_firmware2.02 or later
- eaton easy-e4-dc-6ae1p_firmware2.02 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eaton easy_e4-ac-8re1p_firmware | v < 2.02 | 2.02 |
| eaton easy-box-e4-ac1_firmware | v < 2.02 | 2.02 |
| eaton easy-box-e4-dc1_firmware | v < 2.02 | 2.02 |
| eaton easy-box-e4-uc1_firmware | v < 2.02 | 2.02 |
| eaton easy-e4-ac-12rc1p_firmware | v < 2.02 | 2.02 |
| eaton easy-e4-ac-12rcx1p_firmware | v < 2.02 | 2.02 |
| eaton easy-e4-ac-16re1p_firmware | v < 2.02 | 2.02 |
| eaton easy-e4-dc-12tc1p_firmware | v < 2.02 | 2.02 |
| eaton easy-e4-dc-12tcx1p_firmware | v < 2.02 | 2.02 |
| eaton easy-e4-dc-16te1p_firmware | v < 2.02 | 2.02 |
| eaton easy-e4-dc-4pe1p_firmware | v < 2.02 | 2.02 |
| eaton easy-e4-dc-6ae1p_firmware | v < 2.02 | 2.02 |
| eaton easy-e4-dc-8te1p_firmware | v < 2.02 | 2.02 |
| eaton easy-e4-uc-12rc1p_firmware | v < 2.02 | 2.02 |
| eaton easy-e4-uc-12rcx1p_firmware | v < 2.02 | 2.02 |
| eaton easy-e4-uc-16re1_firmware | v < 2.02 | 2.02 |
| eaton easy-e4-uc-16re1p_firmware | v < 2.02 | 2.02 |
| eaton easy-e4-uc-8re1p_firmware | v < 2.02 | 2.02 |
| eaton xv-102-a035tqrb-1e4_firmware | v < 2.02 | 2.02 |
| eaton xv-102-a3-57tvrb-1e4_firmware | v < 2.02 | 2.02 |
| eaton xv100-box-e4-dc1_firmware | v < 2.02 | 2.02 |
| eaton xv100-box-e4-uc1_firmware | v < 2.02 | 2.02 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.