CVE-2020-10633: Hms-Networks Ewon Cosy Firmware

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can be successful.

Affected products

• Hms-Networks Ewon Cosy Firmware: before 14.1s0 (fixed in 14.1s0)
• Hms-Networks Ewon Flexy Firmware: before 14.1s0 (fixed in 14.1s0)

Published 2020-04-08. Last modified 2026-06-17.