CVE-2020-10633: XSS
A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can be successful.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-10633.
What is the severity of CVE-2020-10633?
The severity of CVE-2020-10633 is medium.
What is the affected software for CVE-2020-10633?
The affected software for CVE-2020-10633 is eWON Flexy and Cosy firmware versions prior to 14.1s0.
How does CVE-2020-10633 work?
CVE-2020-10633 is a non-persistent XSS (cross-site scripting) vulnerability that allows an attacker to initiate a password change for the eWON Flexy and Cosy devices by sending a specially crafted URL.
Is there a fix for CVE-2020-10633?
Yes, upgrading to firmware version 14.1s0 or later will fix CVE-2020-10633.