The vulnerability resides in the weak entropy used for authentication cookies in certain HMS Networks devices. An attacker who obtains a session cookie can brute‑force the encryption parameter used by the cookie to recover the user password, enabling unauthorized access to the device. This flaw aligns with CWE‑315, which concerns the clear‑text storage or transmission of sensitive information. The impact is the potential compromise of device credentials and subsequent full admin access, resulting in a critical confidentiality and integrity breach.

HMS Networks Ewon Flexy firmware versions prior to 15.0s4, Cosy+ firmware 22.xx versions earlier than 22.1s6, and Cosy+ firmware 23.xx versions earlier than 23.0s3 are affected. Any device running these specific versions is at risk of the described credential extraction flaw.

The flaw has a CVSS score of 9.1, indicating a high severity risk. The EPSS score is below 1%, suggesting that exploitation in the wild is low probability, yet the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an attacker to already possess a stolen session cookie. With that cookie, the attacker can brute‑force the weakly generated encryption parameter to discover the user password. Once the password is known, the attacker can gain full administrative control over the device.