The vulnerability is a stack buffer overflow (CWE-121) present in HMS Networks Ewon Flexy and Cosy+ devices. Key detail from the CVE description: the overflow can cause a denial of service and, if exploited, can lead to unauthenticated remote code execution. The impact includes loss of availability and potential compromise of confidentiality and integrity if the remote code execution is achieved. The overflow occurs during firmware processing of certain inputs, allowing an attacker to overwrite return addresses and execute arbitrary code.

Affected vendors and products are HMS Networks Ewon Flexy firmware before 15.0s4, Cosy+ firmware 22.xx before 22.1s6, and Cosy+ firmware 23.xx before 23.0s3. No additional vendor-specific version information is provided beyond the firmware version ranges.

The severity rating is CVSS 9.8, indicating a critical risk. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote and unauthenticated; an attacker can trigger the overflow from a remote machine without authentication.