Lucene search

MitreCVE-2024-33897

HistoryAug 06, 2024 - 2:16 p.m.

CVE-2024-33897

2024-08-0614:16:03

CWE-425

mitre

web.nvd.nist.gov

compromised device

certificate signing request

talk2m

availability issue

patched

april 18 2024

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AI Score

Confidence

Low

EPSS

0.001

Percentile

24.8%

JSON

A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024.

Affected configurations

Nvd

Node

hms-networksewon_cosy\+_firmwareRange21.0s0–21.2s10

hms-networksewon_cosy\+_firmwareRange22.0s0–22.1s3

AND

hms-networksewon_cosy\+Match-

VendorProductVersionCPE
hms-networksewon_cosy\+_firmware*cpe:2.3:o:hms-networks:ewon_cosy\+_firmware:*:*:*:*:*:*:*:*
hms-networksewon_cosy\+-cpe:2.3:h:hms-networks:ewon_cosy\+:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hms-networks	ewon_cosy\+_firmware	*	cpe:2.3:o:hms-networks:ewon_cosy\+_firmware::::::::
hms-networks	ewon_cosy\+	-	cpe:2.3:h:hms-networks:ewon_cosy\+:-:::::::*

References

blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/

hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf

www.ewon.biz/products/cosy/ewon-cosy-wifi

www.hms-networks.com/cyber-security

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AI Score

Confidence

Low

EPSS

0.001

Percentile

24.8%

JSON

Related for CVE-2024-33897