CVE-2026-22614

The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and the local host machine could potentially read the sensitive information stored and tamper with the project file. This security issue has been fixed in the latest version of Eaton EasySoft which is available on the Eaton download centre.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1023.pdf	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:eaton:easysoft:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-10 18:18

Updated : 2026-06-17 10:20

NVD link : CVE-2026-22614

Mitre link : CVE-2026-22614

CVE.ORG link : CVE-2026-22614

JSON object : View

Products Affected

eaton

easysoft

CWE

CWE-257

Storing Passwords in a Recoverable Format

{"id": "CVE-2026-22614", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22614", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T13:49:20.151718Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "CybersecurityCOE@eaton.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "CybersecurityCOE@eaton.com", "affectedData": [{"vendor": "Eaton", "product": "EasySoft", "versions": [{"status": "affected", "version": "0", "lessThan": "8.4", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-10T18:18:12.420", "references": [{"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1023.pdf", "tags": ["Mitigation", "Vendor Advisory"], "source": "CybersecurityCOE@eaton.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "CybersecurityCOE@eaton.com", "description": [{"lang": "en", "value": "CWE-257"}]}], "descriptions": [{"lang": "en", "value": "The encryption mechanism used in Eaton's EasySoft project file was\u00a0insecure and susceptible to brute force attacks, an attacker with access to this file and the local host\nmachine could potentially read the sensitive information stored and tamper with the project file. This security issue has been fixed in the latest version of Eaton EasySoft which is available on the Eaton download centre."}, {"lang": "es", "value": "El mecanismo de cifrado utilizado en el archivo de proyecto EasySoft de Eaton era inseguro y susceptible a ataques de fuerza bruta, un atacante con acceso a este archivo y la m\u00e1quina anfitriona local podr\u00eda potencialmente leer la informaci\u00f3n sensible almacenada y manipular el archivo de proyecto. Este problema de seguridad ha sido solucionado en la \u00faltima versi\u00f3n de Eaton EasySoft, que est\u00e1 disponible en el centro de descargas de Eaton."}], "lastModified": "2026-06-17T10:20:10.037", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eaton:easysoft:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7E5837B-5467-425F-A826-7FDAA54B79A7", "versionEndExcluding": "8.41"}], "operator": "OR"}]}], "sourceIdentifier": "CybersecurityCOE@eaton.com"}