Clear Text Transmission Vulnerability in EWON Flexy 202 by HMS Networks
CVE-2025-0432
6.9MEDIUM
What is CVE-2025-0432?
The EWON Flexy 202 device has a significant vulnerability where user credentials are transmitted in clear text without any encryption. This occurs when users are added or their credentials are modified via the device's web interface. As such, unauthorized actors could easily intercept sensitive information during these processes, posing severe risks to user security and data integrity.
Affected Version(s)
Ewon Flexy 202 All
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Khalid Markar, Parul Sindhwad and Dr. Faruk Kazi from CoE-CNDS Lab, VJTI, Mumbai, India reported this vulnerability to CISA