HMS Networks Ewon Devices Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in HMS Networks Ewon Flexy and Cosy+ devices, allowing unauthenticated attackers to cause a device reboot. This issue is present in Ewon Flexy with firmware prior to 15.0s4, and in Ewon Cosy+ with firmware 22.xx prior to 22.1s6 and 23.xx prior to 23.0s3. The vulnerability can be exploited by sending a specially crafted HTTP request to the device's graphical user interface (GUI).

Impact

Exploitation of this vulnerability leads to a denial-of-service condition by causing the device to reboot.

Remediation

Users are advised to update Ewon Flexy devices to firmware 15.0s4 or greater, and Ewon Cosy+ devices to firmware 22.1s6 or greater, or 23.0s3 or greater, depending on their current version.