medium6.8
CVE-2023-43776
Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access.
Impact
Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Eaton | Easy-Box-E4-Ac1 Firmware | before 2.02 |
| Eaton | Easy-Box-E4-Dc1 Firmware | before 2.02 |
| Eaton | Easy-Box-E4-Uc1 Firmware | before 2.02 |
| Eaton | Easy-E4-Ac-12rc1p Firmware | before 2.02 |
| Eaton | Easy-E4-Ac-12rcx1p Firmware | before 2.02 |
| Eaton | Easy-E4-Ac-16re1p Firmware | before 2.02 |
| Eaton | Easy E4-Ac-8re1p Firmware | before 2.02 |
| Eaton | Easy-E4-Dc-12tc1p Firmware | before 2.02 |
| Eaton | Easy-E4-Dc-12tcx1p Firmware | before 2.02 |
| Eaton | Easy-E4-Dc-16te1p Firmware | before 2.02 |
| Eaton | Easy-E4-Dc-4pe1p Firmware | before 2.02 |
| Eaton | Easy-E4-Dc-6ae1p Firmware | before 2.02 |