CVE-2020-16230: Low severity hms networks ewon flexy and ewon cosy vulnerability
All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as () under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing (CORS) configuration that could abuse this vulnerability, allowing the attacker to retrieve limited confidential information through sniffing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-16230?
CVE-2020-16230 is rated as critical due to the potential for unauthorized access and script injection in vulnerable Ewon Flexy and Cosy devices.
How do I fix CVE-2020-16230?
To fix CVE-2020-16230, upgrade your Ewon Flexy or Cosy firmware to version 14.1 or later.
What systems are affected by CVE-2020-16230?
CVE-2020-16230 affects all versions of Ewon Flexy and Cosy devices prior to firmware version 14.1.
What can an attacker do with CVE-2020-16230?
An attacker leveraging CVE-2020-16230 can inject scripts into the Cross-origin Resource Sharing (CORS) configuration, compromising the device.
Is there a workaround for CVE-2020-16230?
There are no specific workarounds for CVE-2020-16230; updating to the latest firmware is the recommended mitigation.