The vulnerability is an insufficiently strong password policy in Eaton easyE4. An attacker who obtains a password hash—such as via the related CVE-2026-41020—can perform an offline password‑guessing attack, potentially revealing user credentials. The weakness corresponds to CWE‑521 and allows an adversary to compromise authentication confidentiality.

Eaton easyE4. No specific affected versions are listed in the data.

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so publicly available exploits are unknown. Exploitation requires that an attacker first obtain a password hash, which may be possible via CVE-2026-41020 or other means. Once a hash is in hand, the offline guessing attack has a low effort barrier and can lead directly to credential compromise.