The vulnerability stems from an insecure encryption mechanism applied to the project files of Eaton EasySoft. An attacker who can access the file on the local host could brute‑force the encryption, revealing any sensitive data stored within and potentially modifying the file. The weakness maps to CWE‑257, indicating credentials or secrets are stored in a hard‑coded or weakly encrypted form.

Affected systems are installations of Eaton EasySoft, the vendor product in the IEC. No specific version ranges are listed, however the advisory states that the issue has been fixed in the latest release available from Eaton's download centre.

The CVSS score of 6.1 classifies the risk as medium; the EPSS score is below 1%, indicating a low likelihood of exploitation at present. The vulnerability is not listed in the KEV catalog, yet its local‑host attack surface and potential to disclose sensitive information warrant timely remediation. The exploit would require the attacker to obtain local file access and then persist through a brute‑force attempt against the encryption.