Skip to main content

Ewon Cosy Firmware CVE-2024-33892

HIGH
Cleartext Storage of Sensitive Information (CWE-312)
2024-08-02 cve@mitre.org
Information Disclosure Ewon Cosy Firmware
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Aug 02, 2024 - 18:16 nvd
HIGH 7.5

DescriptionNVD

Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies. This is fixed in version 21.2s10 and 22.1s3

AnalysisAI

Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-312. Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies. This is fixed in version 21.2s10 and 22.1s3 Affected products include: Hms-Networks Ewon Cosy\+ Firmware. Version information: version 21.2.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Ewon Cosy Firmware

View all
CVE-2024-33897 CRITICAL POC
9.1 Aug 06

A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another d
CVE-2024-33894 HIGH POC
8.8 Aug 02

Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3
CVE-2024-33896 HIGH POC
7.2 Aug 02

Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due
CVE-2024-33895 MEDIUM POC
6.6 Aug 02

Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 use a unique key to encrypt the conf
CVE-2024-33893 MEDIUM POC
6.1 Aug 02

Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to XSS when displayin
CVE-2020-10633 MEDIUM
6.1 Apr 08

A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to

CVE-2020-16230 LOW
2.3 Sep 18

All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. Ra

Same weakness CWE-312 – Cleartext Storage of Sensitive Information

View all
CVE-2025-22896 CRITICAL POC
9.2
CVE-2023-31069 CRITICAL POC
9.8
CVE-2022-26148 CRITICAL POC
9.8
CVE-2021-29954 CRITICAL POC
9.8
CVE-2020-5723 CRITICAL POC
9.8
CVE-2019-19228 CRITICAL POC
9.8
CVE-2019-13096 CRITICAL POC
9.8
CVE-2019-11384 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2024-33892 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy