HMS Networks Ewon Flexy 202 Cleartext Transmission of User Credentials Vulnerability

A vulnerability exists in the Ewon Flexy 202 device, where user credentials are transmitted in clear text without any encryption. This issue arises when users are added or when user credentials are modified through the device's web interface. The vulnerability affects all versions of the Ewon Flexy 202.

Impact

Exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive user credentials.

Remediation

HMS Networks recommends integrating Ewon Flexy devices with the Talk2M Cloud for secure remote access. Users should also follow the best practices outlined in the 'Best Practices for Secure Usage of the Ewon Solution' document, available on the HMS Networks website. Additionally, unused protocols should be disabled. For more information on how to block unused Ewon services, consult the HMS support article 'How to Block Unused Ewon Flexy Cosy131 Services'.