Cross-site scripting in eWON Flexy and Cosy
Priority LOW 28CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can be successful.
Why it matters now
EPSS 0.00687 52nd percentileScored 2026-11-07
Fix Fixed eWON Flexy and Cosy: 14.1s0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | eWON Flexy and Cosy | before 14.1s0 | 14.1s0 | Patch available | CNA |
- eWON Flexy and Cosy Vendor— Affected before 14.1s0 Fixed in 14.1s0 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hms-networks:ewon_flexy_firmware:*:*:*:*:*:*:*:* | before 14.1s0 | Vulnerable | HMS Networks |
| cpe:2.3:h:hms-networks:ewon_flexy:-:*:*:*:*:*:*:* | not specified by NVD | Running on | HMS Networks |
| cpe:2.3:o:hms-networks:ewon_cosy_firmware:*:*:*:*:*:*:*:* | before 14.1s0 | Vulnerable | HMS Networks |
| cpe:2.3:h:hms-networks:ewon_cosy:-:*:*:*:*:*:*:* | not specified by NVD | Running on | HMS Networks |
- cpe:2.3:o:hms-networks:ewon_flexy_firmware:*:*:*:*:*:*:*:* Versions before 14.1s0 Vulnerable ·HMS Networks
- cpe:2.3:h:hms-networks:ewon_flexy:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HMS Networks
- cpe:2.3:o:hms-networks:ewon_cosy_firmware:*:*:*:*:*:*:*:* Versions before 14.1s0 Vulnerable ·HMS Networks
- cpe:2.3:h:hms-networks:ewon_cosy:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HMS Networks
Remediation
- Fix · CNA eWON Flexy and Cosy Fixed in 14.1s0
Timeline
- 2026-10-02 Threatist record created from CVE-2020-10633
- 2026-10-03 Alias added: GHSA-22gj-rr23-9xgc
References
More HMS Networks Ewon Cosy Firmware vulnerabilities
- TI-2020-12759 All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which… CVSS 3.1LOW 2.3
Sources
- CVE-2020-10633 · CVE Program
- CVE-2020-10633 · NVD
- FIRST EPSS
- GHSA-22gj-rr23-9xgc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences