HMS Networks vulnerabilities
We track 9 vulnerabilities in HMS Networks products across 8 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on October 20, 2026.
Latest HMS Networks vulnerabilities
- 7.1 High severity
PEAK-System Device Driver Setup: Improper Validation of Array Index
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination.
- 8.6 High severity
Ewon Flexy 205: Improper Control of Generation of Code
A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device. This issue affects Ewon Flexy 205: through 14.8s0 (#2633).
- 8.2 High severity
EWON FLEXY 202: Insufficiently Protected Credentials
The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the credentials.
- 9.1 Critical severity
ewon_cosy_firmware: Direct Request
A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024.
- 7.2 High severity
Ewon Cosy+ Firmware: Improper Neutralization of Special Elements used in an OS Command
Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due to improper parameter blacklisting. This is fixed in version 21.2s10 and 22.1s3.
- 8.8 High severity
ewon_cosy: Improper Privilege Management
Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are executing several processes with elevated privileges.
- 7.5 High severity
ewon_cosy_firmware: Cleartext Storage of Sensitive Information
Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies. This is fixed in version 21.2s10 and 22.1s3
- 8.8 High severity
anybus_x-gateway_ab7832-f: Improper Authentication
An issue was discovered on HMS Anybus X-Gateway AB7832-F firmware version 3. The HICP protocol allows unauthenticated changes to a device's network configurations.
- 7.5 High severity
anybus_x-gateway_ab7832-f3: Use of HTTP Request With Sensitive Query String
An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes a web interface on port 80. An unauthenticated GET request to a specific URL triggers the reboot of the Anybus gateway (or at least most of its modules). An attacker can us