Ewon Cosy+ Command Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2024-018 Product: Ewon Cosy+ Manufacturer: HMS Industrial Networks AB Affected Versions: Firmware Versions: 21.2s10 and 22.1s3 Tested Versions: Firmware Version: 21.2s7 Vulnerability Type: Improper Neutralization of Special Element...

Industrial Remote Access Tool Ewon Cosy+ Vulnerable to Root Access Attacks

Security vulnerabilities have been disclosed in the industrial remote access solution Ewon Cosy+ that could be abused to gain root privileges to the devices and stage follow-on attacks. The elevated access could then be weaponized to decrypt encrypted firmware files and encrypted data such as...

CVE-2021-33214

In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure, modification of configuration files, or disruption of normal system operation...

Information disclosure

In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure, modification of configuration files, or disruption of normal system operation...

CVE-2021-33214

CVE-2021-33214 affects HMS Networks eCatcher prior to or up to version 6.6.4. The vulnerability arises from weak filesystem permissions that could allow malicious users to access files, potentially leading to sensitive information disclosure, modification of configuration files, or disruption of ...

CVE-2021-33214

In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure, modification of configuration files, or disruption of normal system operation...

Remote Code Execution Vulnerabilities in Secomea, Moxa, and HMS eWon VPNs

Security researchers at Claroty published details on multiple pre-auth remote code execution vulnerabilities affecting virtual private network VPN implementations primarily used to provide remote access to operational technology OT networks. The vulnerabilities could allow unauthenticated attacke...

CVE-2020-16230

All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing CORS configuration that could abuse this vulnerability, allowing the...

CVE-2020-16230

All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing CORS configuration that could abuse this vulnerability, allowing the...

Design/Logic Flaw

All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing CORS configuration that could abuse this vulnerability, allowing the...

CVE-2020-16230

All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing CORS configuration that could abuse this vulnerability, allowing the...

CVE-2020-16230

Vulnerability CVE-2020-16230 affects HMS Networks Ewon Flexy and Cosy, all versions prior to 14.1. The issue is a permissive cross-domain policy using wildcards in CORS, allowing a local-privileged attacker to inject scripts into CORS configuration and sniff limited confidential information. Impa...

HMS Networks Ewon Flexy and Cosy

1. EXECUTIVE SUMMARY CVSS v3 2.3 ATTENTION: Low skill level to exploit Vendor: HMS Networks Equipment: Ewon Flexy and Cosy Vulnerability: Permissive Cross-domain Policy with Untrusted Domains 2. RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to retrieve...

CVE-2020-10633

A non-persistent XSS cross-site scripting vulnerability exists in eWON Flexy and Cosy all firmware versions prior to 14.1s0. An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can ...

CVE-2020-10633

A non-persistent XSS cross-site scripting vulnerability exists in eWON Flexy and Cosy all firmware versions prior to 14.1s0. An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can ...

Cross site scripting

A non-persistent XSS cross-site scripting vulnerability exists in eWON Flexy and Cosy all firmware versions prior to 14.1s0. An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can ...

CVE-2020-10633

A non-persistent XSS cross-site scripting vulnerability exists in eWON Flexy and Cosy all firmware versions prior to 14.1s0. An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can ...

CVE-2020-10633

CVE-2020-10633 is a non-persistent Cross-Site Scripting (CWE-79) vulnerability in HMS Networks eWON Flexy and eWON Cosy firmware versions prior to 14.1s0. An attacker can send a crafted URL to initiate a password change on the device; the target must enter credentials to complete the attack. Affe...

HMS Networks eWON Flexy and eWON Cosy Cross-Site Scripting Vulnerabilities

HMS Networks eWON Flexy and HMS Networks eWON Cosy are both products of the Swedish company HMS Networks.HMS Networks eWON Flexy is an industrial VPN router.HMS Networks eWON Cosy is a gateway product for remote access. A cross-site scripting vulnerability exists in the HMS Networks eWON Flexy an...

HMS Networks eWON Flexy and Cosy

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Exploitable remotely Vendor: HMS Networks Equipment: eWON Flexy and Cosy Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could initiate a password change. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS...