Ewon Cosy+ Firmware vulnerabilities
4 known vulnerabilities in Ewon Cosy+ Firmware from HMS Networks. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
ewon_cosy_firmware: Direct Request
A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024.
- 7.2 High severity
Ewon Cosy+ Firmware: Improper Neutralization of Special Elements used in an OS Command
Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due to improper parameter blacklisting. This is fixed in version 21.2s10 and 22.1s3.
- 8.8 High severity
ewon_cosy: Improper Privilege Management
Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are executing several processes with elevated privileges.
- 7.5 High severity
ewon_cosy_firmware: Cleartext Storage of Sensitive Information
Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies. This is fixed in version 21.2s10 and 22.1s3