CVE-2026-25818: Critical severity HMS Networks Ewon Flexy vulnerability
HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have weak entropy for authentication cookies, allowing an attacker with a stolen session cookie to find the user password by brute-forcing an encryption parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25818?
CVE-2026-25818 has a critical severity rating of 9.1 according to the CVSS v3.1 standard.
How do I fix CVE-2026-25818?
To mitigate CVE-2026-25818, upgrade the firmware of Ewon Flexy to 15.0s4 or later, and Cosy+ to 22.1s6 or later for 22.xx, and to 23.0s3 or later for 23.xx.
What systems are affected by CVE-2026-25818?
CVE-2026-25818 affects HMS Networks Ewon Flexy and Cosy+ devices with specific older firmware versions.
What type of attack does CVE-2026-25818 allow?
CVE-2026-25818 allows an attacker with a stolen session cookie to brute-force the encryption parameter and potentially discover the user password.
What is the risk level associated with CVE-2026-25818?
CVE-2026-25818 has been assessed with a risk level of 66, indicating a high potential impact.