Filtered by vendor Hms-networks Subscriptions
Filtered by product Ewon Cosy Firmware Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-16230 1 Hms-networks 4 Ewon Cosy, Ewon Cosy Firmware, Ewon Flexy and 1 more 2024-11-21 2.3 Low
All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing (CORS) configuration that could abuse this vulnerability, allowing the attacker to retrieve limited confidential information through sniffing.
CVE-2020-10633 1 Hms-networks 4 Ewon Cosy, Ewon Cosy Firmware, Ewon Flexy and 1 more 2024-11-21 6.1 Medium
A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can be successful.
CVE-2024-33892 1 Hms-networks 8 Ewon Cosy\+ 4g Apac, Ewon Cosy\+ 4g Eu, Ewon Cosy\+ 4g Jp and 5 more 2024-09-03 5.3 Medium
Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies. This is fixed in version 21.2s10 and 22.1s3