CVE-2026-25818

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-25818", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-13T12:58:56.027Z", "dateReserved": "2026-02-06T00:00:00.000Z", "datePublished": "2026-03-12T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-12T21:20:43.435Z"}, "descriptions": [{"lang": "en", "value": "HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have weak entropy for authentication cookies, allowing an attacker with a stolen session cookie to find the user password by brute-forcing an encryption parameter."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://www.hms-networks.com/p/flexy20500-00ma-ewon-flexy-205"}, {"url": "https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2026-03-09-001---ewon-several-flexy-and-cosy--vulnerabilities.pdf?sfvrsn=f7c027b8_13"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-315", "lang": "en", "description": "CWE-315 Cleartext Storage of Sensitive Information in a Cookie"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T12:58:09.531269Z", "id": "CVE-2026-25818", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T12:58:56.027Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://www.hms-networks.com/p/flexy20500-00ma-ewon-flexy-205"}, {"url": "https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2026-03-09-001---ewon-several-flexy-and-cosy--vulnerabilities.pdf?sfvrsn=f7c027b8_13"}], "descriptions": [{"lang": "en", "value": "HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have weak entropy for authentication cookies, allowing an attacker with a stolen session cookie to find the user password by brute-forcing an encryption parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-12T21:20:43.435Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-25818", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-13T12:58:09.531269Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-315", "description": "CWE-315 Cleartext Storage of Sensitive Information in a Cookie"}]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-13T12:58:51.647Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-25818", "state": "PUBLISHED", "dateUpdated": "2026-03-12T21:20:43.435Z", "dateReserved": "2026-02-06T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-12T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have weak entropy for authentication cookies, allowing an attacker with a stolen session cookie to find the user password by brute-forcing an encryption parameter."}, {"lang": "es", "value": "HMS Networks Ewon Flexy con firmware anterior a 15.0s4, Cosy+ con firmware 22.xx anterior a 22.1s6, y Cosy+ con firmware 23.xx anterior a 23.0s3 tienen entrop\u00eda d\u00e9bil para las cookies de autenticaci\u00f3n, permitiendo a un atacante con una cookie de sesi\u00f3n robada encontrar la contrase\u00f1a del usuario mediante fuerza bruta sobre un par\u00e1metro de cifrado."}], "id": "CVE-2026-25818", "lastModified": "2026-06-17T10:25:17.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25818", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T12:58:09.531269Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:27.353", "references": [{"source": "cve@mitre.org", "url": "https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2026-03-09-001---ewon-several-flexy-and-cosy--vulnerabilities.pdf?sfvrsn=f7c027b8_13"}, {"source": "cve@mitre.org", "url": "https://www.hms-networks.com/p/flexy20500-00ma-ewon-flexy-205"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-315"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,22.1s6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,23.0s3)"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 87.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "ewon_cosy", "vendor": "hms-networks"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,15.0s4)"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "ewon_flexy", "vendor": "hms-networks"}], "analysis": {"en": {"generated_at": "2026-03-18T15:02:08.873202+00:00", "value": {"mitigation_remediation": ["Update Ewon Flexy to firmware 15.0s4 or later. Update Cosy+ to firmware 22.1s6 or later if running 22.xx, or to firmware 23.0s3 or later if running 23.xx. Check the official HMS Networks update pages or vendor support for the latest available firmware releases."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Access via Credential Disclosure"}, "threat_synthesis": {"affected_systems": "HMS Networks Ewon Flexy firmware versions prior to 15.0s4, Cosy+ firmware 22.xx versions earlier than 22.1s6, and Cosy+ firmware 23.xx versions earlier than 23.0s3 are affected. Any device running these specific versions is at risk of the described credential extraction flaw.", "description_and_impact": "The vulnerability resides in the weak entropy used for authentication cookies in certain HMS Networks devices. An attacker who obtains a session cookie can brute\u2011force the encryption parameter used by the cookie to recover the user password, enabling unauthorized access to the device. This flaw aligns with CWE\u2011315, which concerns the clear\u2011text storage or transmission of sensitive information. The impact is the potential compromise of device credentials and subsequent full admin access, resulting in a critical confidentiality and integrity breach.", "risk_and_exploitability": "The flaw has a CVSS score of 9.1, indicating a high severity risk. The EPSS score is below 1%, suggesting that exploitation in the wild is low probability, yet the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an attacker to already possess a stolen session cookie. With that cookie, the attacker can brute\u2011force the weakly generated encryption parameter to discover the user password. Once the password is known, the attacker can gain full administrative control over the device."}}}}, "created": "2026-03-13T09:53:58.016691+00:00", "title": "Weak Cookie Entropy Enabling Password Brute\u2011Force on HMS Networks Ewon Flexy and Cosy+", "updated": "2026-03-20T15:36:32.279683+00:00", "vendors": ["hms-networks", "hms-networks$PRODUCT$ewon_cosy", "hms-networks$PRODUCT$ewon_flexy"]}