CVE-2020-16230
Low
Description
All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing (CORS) configuration that could abuse this vulnerability, allowing the attacker to retrieve limited confidential information through sniffing.
SeverityLow
CVSS2.3
Exploit probability—
ProductHms-networks Ewon Flexy Firmware
PublishedSep 18, 2020
First seenSep 18, 2020
How to fix
Update
- hms-networks ewon_flexy_firmware14.1 or later
- hms-networks ewon_cosy_firmware14.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hms-networks ewon_flexy_firmware | v < 14.1 | 14.1 |
| hms-networks ewon_cosy_firmware | v < 14.1 | 14.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.