CVE-2026-25817

HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have improper neutralization of special elements used in an OS command allowing remote code execution by attackers with low privilege access on the gateway, provided the attacker has credentials.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2026-03-09-001---ewon-several-flexy-and-cosy--vulnerabilities.pdf?sfvrsn=f7c027b8_13
https://www.hms-networks.com/p/flexy20500-00ma-ewon-flexy-205

Configurations

No configuration.

History

27 Apr 2026, 19:18

Type	Values Removed	Values Added
Summary		(es) HMS Networks Ewon Flexy con firmware anterior a 15.0s4, Cosy+ con firmware 22.xx anterior a 22.1s6, y Cosy+ con firmware 23.xx anterior a 23.0s3 tienen una neutralización incorrecta de elementos especiales utilizados en un comando del sistema operativo, permitiendo la ejecución remota de código por atacantes con acceso de bajo privilegio en la pasarela, siempre que el atacante tenga credenciales.

13 Mar 2026, 19:54

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-13 19:54

Updated : 2026-06-17 10:25

NVD link : CVE-2026-25817

Mitre link : CVE-2026-25817

CVE.ORG link : CVE-2026-25817

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-25817", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25817", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-13T12:54:57.983949Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-13T19:54:25.283", "references": [{"url": "https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2026-03-09-001---ewon-several-flexy-and-cosy--vulnerabilities.pdf?sfvrsn=f7c027b8_13", "source": "cve@mitre.org"}, {"url": "https://www.hms-networks.com/p/flexy20500-00ma-ewon-flexy-205", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have improper neutralization of special elements used in an OS command allowing remote code execution by attackers with low privilege access on the gateway, provided the attacker has credentials."}, {"lang": "es", "value": "HMS Networks Ewon Flexy con firmware anterior a 15.0s4, Cosy+ con firmware 22.xx anterior a 22.1s6, y Cosy+ con firmware 23.xx anterior a 23.0s3 tienen una neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando del sistema operativo, permitiendo la ejecuci\u00f3n remota de c\u00f3digo por atacantes con acceso de bajo privilegio en la pasarela, siempre que el atacante tenga credenciales."}], "lastModified": "2026-06-17T10:25:17.620", "sourceIdentifier": "cve@mitre.org"}