{"id":"CVE-2023-43776","aliases":["EUVD-2023-48153","GHSA-35hg-f9qq-236g"],"status":"published","title":"Weak encoding vulnerability in easyE4","description":"Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending).","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00139,"percentile":0.03305,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-261","CWE-326"],"published":"2023-10-17T12:35:09Z","modified":"2026-06-17T06:26:25Z","products":[{"vendor":"eaton","product":"easy-box-e4-ac1_firmware"},{"vendor":"eaton","product":"easy-box-e4-dc1_firmware"},{"vendor":"eaton","product":"easy-box-e4-uc1_firmware"},{"vendor":"eaton","product":"easy-e4-ac-12rc1p_firmware"},{"vendor":"eaton","product":"easy-e4-ac-12rcx1p_firmware"},{"vendor":"eaton","product":"easy-e4-ac-16re1p_firmware"},{"vendor":"eaton","product":"easy-e4-dc-12tc1p_firmware"},{"vendor":"eaton","product":"easy-e4-dc-12tcx1p_firmware"},{"vendor":"eaton","product":"easy-e4-dc-16te1p_firmware"},{"vendor":"eaton","product":"easy-e4-dc-4pe1p_firmware"},{"vendor":"eaton","product":"easy-e4-dc-6ae1p_firmware"},{"vendor":"eaton","product":"easy-e4-dc-8te1p_firmware"},{"vendor":"eaton","product":"easy-e4-uc-12rc1p_firmware"},{"vendor":"eaton","product":"easy-e4-uc-12rcx1p_firmware"},{"vendor":"eaton","product":"easy-e4-uc-16re1_firmware"},{"vendor":"eaton","product":"easy-e4-uc-16re1p_firmware"},{"vendor":"eaton","product":"easy-e4-uc-8re1p_firmware"},{"vendor":"eaton","product":"easy_e4-ac-8re1p_firmware"},{"vendor":"eaton","product":"easye4"},{"vendor":"eaton","product":"xv-102-a035tqrb-1e4_firmware"},{"vendor":"eaton","product":"xv-102-a3-57tvrb-1e4_firmware"},{"vendor":"eaton","product":"xv100-box-e4-dc1_firmware"},{"vendor":"eaton","product":"xv100-box-e4-uc1_firmware"}],"references":[{"url":"https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2023-1010.pdf","tags":["x_transferred","Mitigation","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43776"},{"url":"https://github.com/advisories/GHSA-35hg-f9qq-236g"}],"sources":{"cve":[{"id":"CVE-2023-43776","title":"Weak encoding vulnerability in easyE4","description":"Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending).","status":"published","published":"2023-10-17T12:35:09.849Z","modified":"2024-09-13T16:27:22.502Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-261"],"updated_at":"2026-11-02T14:35:15.066338Z"}],"euvd":[{"id":"EUVD-2023-48153","description":"Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending).","status":"published","published":"2023-10-17T12:35:09Z","modified":"2024-09-13T16:27:22Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T00:55:55.467153Z"}],"ghsa":[{"id":"GHSA-35hg-f9qq-236g","title":"Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure...","description":"Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending).","status":"published","published":"2023-10-17T15:30:27Z","modified":"2024-04-04T08:43:10Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-261","CWE-326"],"updated_at":"2026-11-02T14:57:00.717739Z"}],"nvd":[{"id":"CVE-2023-43776","description":"Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending).","status":"published","published":"2023-10-17T13:15:11.75Z","modified":"2026-06-17T06:26:25.297Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-261","CWE-326"],"updated_at":"2026-11-02T14:08:37.83429Z"}]}}