CVE-2026-25817: Code Injection
HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have improper neutralization of special elements used in an OS command allowing remote code execution by attackers with low privilege access on the gateway, provided the attacker has credentials.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25817?
CVE-2026-25817 has a high severity score of 8.8 on the CVSS scale.
How do I fix CVE-2026-25817?
To mitigate CVE-2026-25817, upgrade the Ewon Flexy firmware to version 15.0s4 or newer, and the Cosy+ firmware to version 22.1s6 or newer.
What type of vulnerability is CVE-2026-25817?
CVE-2026-25817 is categorized as a code injection vulnerability that allows remote code execution.
Who is affected by CVE-2026-25817?
Users of HMS Networks Ewon Flexy and Cosy+ products with specific firmware versions are affected by CVE-2026-25817.
What are the potential impacts of CVE-2026-25817?
Exploitation of CVE-2026-25817 could allow attackers with low privilege access to execute arbitrary code on the affected devices.