TI-2023-23472 Aliases CVE-2023-43777 GHSA-m6cj-mh5r-8m7w

Insecure storage of password in easySoft

LOW 29CWE-256Published 2023-10-17 · Updated 2024-09-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-256.

Summary

Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. This software has a password protection functionality to secure the project file from unauthorized access. This password was being stored insecurely and could be retrieved by skilled adversaries.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00321 25th percentileScored 2026-11-07

Fix Fixed easySoft (Eaton): 8.01

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Eaton	easySoft	before 8.01	8.01	Patch available	CNA

easySoft VendorEaton Affected before 8.01 Fixed in 8.01 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:eaton:easysoft::::::::	before 8.01	Vulnerable	Eaton

cpe:2.3:a:eaton:easysoft:*:*:*:*:*:*:*:* Versions before 8.01 Vulnerable ·Eaton

Remediation

Fix · CNA easySoft (Eaton) Fixed in 8.01

Timeline

2026-10-02 Threatist record created from CVE-2023-43777
2026-10-03 Alias added: GHSA-m6cj-mh5r-8m7w

References

Advisory 1

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2023-1011.pdf

TI-2020-05475 File parsing Type Confusion Remote code execution vulerability CVSS 3.1HIGH 7.8
TI-2020-05474 File parsing Out-Of-Bounds read remote code execution CVSS 3.1HIGH 7.8
TI-2026-18175 The encryption mechanism used in Eaton's EasySoft project file was insecure and… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences