CVE-2023-43776 Weak encoding vulnerability in easyE4
Attackers can bypass device password protection by exploiting weak encoding in exported program files, potentially gaining unauthorized access to the PLC.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-43776?
CVE-2023-43776 is a medium-severity vulnerability in Eaton easyE4, published on 17 Oct 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending).
Which versions are affected by CVE-2023-43776?
It affects 22 products.
Products include Eaton Easy-Box-E4-Ac1 Firmware, Eaton Easy-Box-E4-Dc1 Firmware, Eaton Easy-Box-E4-Uc1 Firmware, Eaton Easy-E4-Ac-12rc1p Firmware, Eaton Easy-E4-Ac-12rcx1p Firmware, Eaton Easy-E4-Ac-16re1p Firmware and 16 more.
How do I fix CVE-2023-43776?
No fix has been published for CVE-2023-43776 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-43776 being exploited?
There is no known exploitation of CVE-2023-43776 in the wild and no public exploit code.
Sources
Also known as GHSA-35hg-f9qq-236g.