CVEvulnerability

CVE-2026-25817

8.8 HIGH Published 2026-03-13 Modified 2026-06-17 Official page ↗

Status: Deferred
Published: 2026-03-13
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-94

Description

HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have improper neutralization of special elements used in an OS command allowing remote code execution by attackers with low privilege access on the gateway, provided the attacker has credentials.

Weakness · CWE (1)

CWE-94 Improper Control of Generation of Code weakness

References

https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2026-03-09-001---ewon-several-flexy-and-cosy--vulnerabilities.pdf?sfvrsn=f7c027b8_13 hmsnetworks.blob.core.windows.net
https://www.hms-networks.com/p/flexy20500-00ma-ewon-flexy-205 www.hms-networks.com

CVE-2026-25817

Description

Related

Weakness · CWE (1)

References