Hms-Networks
15 CVEs across 34 Hms-Networks products. Browse Hms-Networks vulnerabilities, severities, and proof-of-concept exploits.
Hms-Networks products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0432 | Medium | 5.7 | 2025-01-28 | EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are changed via its webpage. |
CVE-2024-9154 | | 2024-12-19 | A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device. This issue affects Ewon Flexy 205: throu… | |
CVE-2024-7755 | High | 8.2 | 2024-10-17 | The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the cr… |
CVE-2024-33897 | Critical | 9.1 | 2024-08-06 | A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability iss… |
CVE-2024-33896 | High | 7.2 | 2024-08-02 | Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due to improper parameter blacklisting. Th… |
CVE-2024-33895 | Medium | 6.6 | 2024-08-02 | Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 use a unique key to encrypt the configuration parameters. This is fixed in… |
CVE-2024-33894 | High | 8.8 | 2024-08-02 | Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are executing several processes with e… |
CVE-2024-33893 | Medium | 6.1 | 2024-08-02 | Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to XSS when displaying the logs due to improper input saniti… |
CVE-2024-33892 | High | 7.5 | 2024-08-02 | Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking informatio… |
CVE-2024-6558 | Medium | 6.3 | 2024-07-25 | HMS Industrial Networks Anybus-CompactCom 30 products are vulnerable to a XSS attack caused by the lack of input sanitation checks. As a consequence, it is po… |
CVE-2021-33214 | Medium | 6.1 | 2021-07-09 | In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure… |
CVE-2020-16230 | Low | 2.3 | 2020-09-18 | All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high pr… |
CVE-2020-14498 | Critical | 9.6 | 2020-08-26 | HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute… |
CVE-2020-10633 | Medium | 6.1 | 2020-04-08 | A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a speci… |
CVE-2018-19694 | Medium | 6.1 | 2019-03-21 | HMS Industrial Networks Netbiter WS100 3.30.5 devices and previous have reflected XSS in the login form. |