Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-41020 is a high-severity Authentication Bypass by Capture-replay (CWE-294) vulnerability in Eaton (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 13th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-23 (Session Authenticity) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-110808
Vulnerability Data
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
MITRE ATT&CK v20.0
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.4.16V10.5.1
Mitigating Controls (NIST 800-53 r5)
Our mappings, made for this CVE.
Session authenticity mechanisms directly stop replay of captured authentication traffic by enforcing freshness or cryptographic binding.
Transmission integrity (with anti-replay) stops captured messages from being accepted as valid later.
Mitigating Controls (NIST CSF 2.0)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.
Protecting and verifying identity assertions prevents replay of captured authentication material.
Encryption and integrity protections for data-in-transit directly block capture-replay of credentials or tokens.
Network monitoring may detect anomalous replays after the fact but does not prevent the design flaw.
Strong authentication methods can reduce replay risk but do not inherently address captured messages.
Mitigating Controls (ISO/IEC 27001:2022 Annex A)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.
Cryptographic protections (e.g., nonces, timestamps, message authentication codes) make captured authentication messages unusable for replay.
A.8.28's secure design/architecture and threat modelling guidance (planning item g) and its prohibition on insecure design techniques can catch capture-replay during design, but the clause mandates a fallible practice whose effect depends on developer rigour, so only a minority of instances are prevented.
A.8.5 addresses several vectors relevant to capture-replay: item (j) bars cleartext password transmission, items (k) and (l) shorten the window via session termination and connection-duration limits, and the strong-authentication and MFA guidance (certificates, smart cards, tokens) typically carries replay protection as part of those mechanisms. But the clause does not mandate anti-replay primitives (nonces, timestamps, challenge-response) at the protocol level, and for non-critical systems password-only authentication remains acceptable, so a system compliant with A.8.5 can still be vulnerable to capture-replay — the remainder is nameable and not bounded to a vanishing slice.
A.8.8's reach is DISCLOSURE-based, and CWE-294 does surface as CVEs (observed examples include CVE-2005-3435 and CVE-2007-4961), so vulnerability scanning, advisory tracking, and external reports will surface some instances; the disclosed share of any weakness class is a minority, capping the rung at `partial`.