CVE-2020-16230: Hms-Networks Ewon Cosy Firmware

Low severity, CVSS 2.3. EPSS: 0.3% chance of exploitation in the next 30 days.

All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing (CORS) configuration that could abuse this vulnerability, allowing the attacker to retrieve limited confidential information through sniffing.

Affected products

• Hms-Networks Ewon Cosy Firmware: before 14.1 (fixed in 14.1)
• Hms-Networks Ewon Flexy Firmware: before 14.1 (fixed in 14.1)

Published 2020-09-18. Last modified 2026-06-17.