CVE-2020-10633
Medium
Description
A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can be successful.
SeverityMedium
CVSS6.1
Exploit probability—
ProductHms-networks Ewon Flexy Firmware
PublishedApr 8, 2020
First seenApr 8, 2020
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- hms-networks ewon_flexy_firmware14.1s0 or later
- hms-networks ewon_cosy_firmware14.1s0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hms-networks ewon_flexy_firmware | v < 14.1s0 | 14.1s0 |
| hms-networks ewon_cosy_firmware | v < 14.1s0 | 14.1s0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.