Cross-Origin Resource Sharing Vulnerability in Ewon Flexy and Cosy Products
CVE-2020-16230

2.3LOW

Key Information:

Vendor

Hms-networks

Status
Hms Networks Ewon Flexy And Cosy
Vendor
CVE Published:
18 September 2020

What is CVE-2020-16230?

Ewon Flexy and Cosy devices prior to version 14.1 contain a security vulnerability related to Cross-origin Resource Sharing (CORS) configurations. The use of wildcards in domain requests allows an attacker with local access and elevated privileges to inject harmful scripts into the CORS settings. This exploitation can enable unauthorized retrieval of sensitive information through data sniffing techniques, posing a significant risk to user privacy and data integrity.

Affected Version(s)

HMS Networks Ewon Flexy and Cosy All versions prior to 14.1

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-254-03
x_refsource_MISC

CVSS V3.1

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.