Threat Investigation
Request a demo

CVE-2026-25819

High

Description

HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 allows unauthenticated attackers to cause a Denial of Service by using a specially crafted HTTP request that leads to a reboot of the device, provided they have access to the device's GUI.

SeverityHigh
CVSS7.5
Exploit probability—
ProductEwon Flexy
PublishedMar 13, 2026
First seenMar 13, 2026
Weakness typeCWE-400Uncontrolled resource consumption

How to fix

Update
  • HMS Networks Ewon Flexy15.0s4 or later
  • HMS Networks Cosy+22.1s6, 23.0s3 or later

Affected products

ProductAffected versionsFixed in
HMS Networks Ewon FlexyNo range specified15.0s4
HMS Networks Cosy+No range specified22.1s6, 23.0s3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.