Eaton EasySoft up to 8.3 Project File password recoverable

Summaryinfo

A vulnerability has been found in Eaton EasySoft up to 8.3 and classified as problematic. This issue affects some unknown processing of the component Project File Handler. Performing a manipulation results in password recoverable. This vulnerability is reported as CVE-2026-22614. The attack requires a local approach. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in Eaton EasySoft up to 8.3. This affects an unknown part of the component Project File Handler. The manipulation with an unknown input leads to a password recoverable vulnerability. CWE is classifying the issue as CWE-257. The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts. This is going to have an impact on confidentiality. The summary by CVE is:

The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and the local host machine could potentially read the sensitive information stored and tamper with the project file. This security issue has been fixed in the latest version of Eaton EasySoft which is available on the Eaton download centre.

It is possible to read the advisory at eaton.com. This vulnerability is uniquely identified as CVE-2026-22614 since 01/08/2026. The exploitability is told to be difficult. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

Upgrading to version 8.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Eaton

Name

• EasySoft

Version

• 8.0
• 8.1
• 8.2
• 8.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion