Eaton easySoft fails to validate TLS certificates presented by easyE4 devices, creating a trust bypass that enables a man‑in‑the‑middle (MitM) attack. This flaw, identified as CWE‑295, can allow an attacker to intercept or alter the data exchanged between the management application and the device, potentially compromising confidentiality and integrity of the communication channel. The CVSS score of 5.9 classifies the vulnerability as moderate severity, indicating that while exploitability is not trivial, the impact on trusted communications is significant.

The vulnerability affects Eaton easySoft software that manages easyE4 devices. No specific product versions are listed in the advisory, so the risk applies to all installations of this platform until a patch or mitigation is applied.

The vulnerability can be leveraged by an attacker on the same network segment as the easyE4 device, as the exploit requires only proximity to the network traffic. Because the EPSS score is not available and the flaw is not presented in CISA’s KEV catalog, the likelihood of exploitation in the wild is uncertain but not negligible. Organizations should treat the risk as moderate, balancing the potential for intercepted or tampered data against the lack of evidence for widespread exploitation.