CVE-2026-25817
OS Command Injection in HMS Networks Ewon Flexy and Cosy
Publication date: 2026-03-13
Last updated on: 2026-03-13
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hms_networks | ewon_flexy | to 15.0s4 (exc) |
| hms_networks | cosy | to 22.1s6 (exc) |
| hms_networks | cosy | to 23.0s3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects HMS Networks Ewon Flexy and Cosy+ devices with certain firmware versions before specified updates. It involves improper neutralization of special elements used in an operating system command, which allows attackers with low privilege access and valid credentials on the gateway to execute remote code.
How can this vulnerability impact me? :
The vulnerability can lead to remote code execution by attackers who have low privilege access and credentials to the affected gateway devices. This means an attacker could potentially take control of the device, leading to full compromise of confidentiality, integrity, and availability of the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade the firmware of your HMS Networks Ewon Flexy and Cosy+ devices to the fixed versions.
- For Ewon Flexy, upgrade to firmware version 15.0s4 or later.
- For Cosy+ devices with firmware 22.xx, upgrade to version 22.1s6 or later.
- For Cosy+ devices with firmware 23.xx, upgrade to version 23.0s3 or later.
Ensure that only authorized users with proper credentials have access to the gateway, as the vulnerability requires attacker credentials.