Weak Entropy Vulnerability in HMS Networks Ewon Flexy and Cosy+ Products
CVE-2026-25818

9.1CRITICAL

Key Information:

Vendor

HMS Networks

Status
Ewon Flexy and Cosy+
Vendor
CVE Published:
12 March 2026

What is CVE-2026-25818?

HMS Networks’ Ewon Flexy and Cosy+ products exhibit a critical vulnerability stemming from weak entropy associated with their authentication cookies. This flaw enables attackers with access to a stolen session cookie to potentially discover user passwords through brute-force attacks targeting an encryption parameter. Users of the affected firmware versions should take immediate action to secure their systems against unauthorized access.

References

https://www.hms-networks.com/p/flexy20500-00ma-ewon-flexy...
https://hmsnetworks.blob.core.windows.net/nlw/docs/defaul...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.