The encryption mechanism used in Eaton's EasySoft project file was insecure and…
Priority LOW 26CWE-257Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and the local host machine could potentially read the sensitive information stored and tamper with the project file. This security issue has been fixed in the latest version of Eaton EasySoft which is available on the Eaton download centre.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0009 0th percentileScored 2026-11-08
Fix Fixed EasySoft (Eaton): 8.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA EasySoft (Eaton) Fixed in 8.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-22614
- 2026-10-03 Alias added: GHSA-wgwf-qr6f-pj7f
References
More Eaton Easysoft vulnerabilities
- TI-2020-05475 File parsing Type Confusion Remote code execution vulerability CVSS 3.1HIGH 7.8
- TI-2020-05474 File parsing Out-Of-Bounds read remote code execution CVSS 3.1HIGH 7.8
- TI-2023-23472 Insecure storage of password in easySoft CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-22614 · CVE Program
- CVE-2026-22614 · NVD
- FIRST EPSS
- GHSA-wgwf-qr6f-pj7f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences