What is the CVSS score of CVE-2026-25819?

CVE-2026-25819 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-25819?

Within 24 hours: Inventory all HMS Networks Ewon devices and document network exposure. Within 7 days: Implement network segmentation to restrict HTTP access to the web GUI and disable internet-facing access where possible. Within 30 days: Monitor vendor advisories for patch availability and establish a testing/deployment plan; evaluate replacing or upgrading affected devices if operational criticality warrants accelerated remediation.

CVE-2026-25819

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-03-13 cve@mitre.org

Denial Of Service

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:22 vuln.today

cvss_changed

Analysis Generated

Mar 13, 2026 - 20:00 vuln.today

CVE Published

Mar 13, 2026 - 19:54 nvd

HIGH 7.5

DescriptionCVE.org

HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 allows unauthenticated attackers to cause a Denial of Service by using a specially crafted HTTP request that leads to a reboot of the device, provided they have access to the device's GUI.

AnalysisAI

CVE-2026-25819 is an unauthenticated denial of service vulnerability affecting HMS Networks Ewon industrial IoT gateways (Flexy and Cosy+ models) that allows remote attackers to reboot devices through specially crafted HTTP requests to the web GUI. With a CVSS score of 7.5 (High) but low EPSS score (0.02%), this vulnerability has not been added to CISA KEV and shows minimal exploitation activity in the wild.

Technical ContextAI

This vulnerability affects HMS Networks' industrial IoT gateway products used for remote monitoring and control of industrial equipment. The root cause is improper resource management (CWE-400) in the device's web server, where specially crafted HTTP requests can trigger uncontrolled resource consumption leading to device reboot. Affected versions include Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3. These devices are commonly deployed in industrial environments for remote access to PLCs and other automation equipment.

Affected ProductsAI

HMS Networks Ewon Flexy (all models) with firmware versions before 15.0s4; HMS Networks Ewon Cosy+ with firmware 22.xx series before version 22.1s6; HMS Networks Ewon Cosy+ with firmware 23.xx series before version 23.0s3. The vulnerability specifically affects devices where the web GUI interface is accessible to potential attackers.

RemediationAI

Update firmware to patched versions: Ewon Flexy to firmware 15.0s4 or later, Cosy+ firmware 22.xx to version 22.1s6 or later, Cosy+ firmware 23.xx to version 23.0s3 or later. As a workaround, restrict network access to the device GUI interface through firewall rules or VPN requirements. Full details available in HMS Networks security advisory at https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2026-03-09-001---ewon-several-flexy-and-cosy--vulnerabilities.pdf.