Security Advisory

CVE-2026-25819: HMS Networks Ewon Flexy / Cosy+ Remote-Access Gateway Unauthenticated Denial of Service (pending)

Last updated:
  • CVE-2026-25819

CVE-2026-25819 is a denial-of-service vulnerability (CWE-400) in the web management GUI of HMS Networks' Ewon Flexy and Cosy+ industrial remote-access VPN gateways: an unauthenticated attacker with network access to the device's GUI can send a specially crafted HTTP request that reboots it, and HMS Networks' own advisory rates the flaw 8.7 (high) on CVSS v4.0 when the GUI is exposed to the network, while CISA's vulnerability-enrichment program separately records a CVSS v3.1 score of 7.5; NVD itself has not published a Primary score.

Vulnerability summary

CVSS base score

N/A

No NVD score published as of

EPSS score (FIRST)

0.6%

Probability of exploitation in the wild in the next 30 days

CISA KEV catalog

No

Not listed

Published

Vulnerability ID: CVE-2026-25819 · Source: NVD

Affected components

ComponentCPEVersion range
HMS Networks Ewon Flexy and Ewon Cosy+ industrial remote-access VPN gateway firmware (web management GUI)—Ewon Flexy and Cosy 131 firmware before 15.0s4; Ewon Cosy+ 22.xx firmware before 22.1s6; Ewon Cosy+ 23.xx firmware from 23.0s0 up to and including 23.0s2; fixed in Flexy/Cosy 131 firmware 15.0s4 or later, and Cosy+ firmware 22.1s6 or 23.0s3 or later, per HMS Security Advisory HMSSAR-2026-03-09-001

What does this mean for affected devices?

CVE-2026-25819 (CWE-400, Uncontrolled Resource Consumption) affects the web management GUI of HMS Networks' Ewon Flexy and Cosy+ industrial remote-access VPN gateways, used to give maintenance engineers and machine builders remote access into OT equipment. NVD's description states: "HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 allows unauthenticated attackers to cause a Denial of Service by using a specially crafted HTTP request that leads to a reboot of the device, provided they have access to the device's GUI" (NVD).

NVD tracks the CVE with status "Deferred": the only CVSS score on record is a CISA Authorized Data Publisher (ADP) submission — CVSS v3.1 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — not an NVD-published Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD).

HMS Networks' own Security Advisory HMSSAR-2026-03-09-001, "Ewon Flexy, Cosy 131 and Ewon Cosy+: Several Vulnerabilities," scores this specific issue separately and differently, using CVSS v4.0: 8.7, labelled "High [when the GUI is exposed to the network]", vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, and recommends blocking GUI access from the WAN — the default behaviour since firmware 15.0. The same bulletin discloses three related flaws found by the same researchers: CVE-2026-25817, a credentialed OS command-injection remote-code-execution bug (CVSS v4.0 9.4); CVE-2026-25818, weak entropy in authentication cookies (CVSS v4.0 6.9); and CVE-2026-25823, a stack buffer overflow that can reach unauthenticated remote code execution (CVSS v4.0 9.5). HMS credits "Mr Nicolas SCHAFF and the team from VOC EDF" for responsibly reporting all four issues, and lists the fix as Flexy/Cosy 131 firmware 15.0s4 or later, and Cosy+ firmware 22.1s6 (22.xx line) or 23.0s3 (23.xx line) or later (HMS Security Advisory HMSSAR-2026-03-09-001).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00561 (46.9th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, operators of Ewon Flexy, Cosy 131 or Cosy+ gateways should update to the fixed firmware above and, per HMS's own recommendation, keep the device's web management GUI off the WAN-facing interface rather than relying on firmware alone.

How to fix this class of issueThis advisory's weakness class is Resource exhaustion. Our practical guide covers how to detect, fix, verify and disclose it: How to fix SQL injection, XSS, resource exhaustion and deserialization flaws in embedded firmware.

Evidence

  • HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 allows unauthenticated attackers to cause a Denial of Service via a specially crafted HTTP request leading to a device reboot, provided they have access to the device's GUI. — NVD
  • NVD status 'Deferred'; the only CVSS score recorded is a CISA ADP-submitted CVSS v3.1 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no NVD-published Primary score as of this review. — NVD
  • HMS's own CVSS v4.0 score for this issue is 8.7 ('High [when the GUI is exposed to the network]'), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N; disclosed alongside CVE-2026-25817, CVE-2026-25818 and CVE-2026-25823 in the same bulletin; fixed in Flexy/Cosy 131 firmware 15.0s4+ and Cosy+ firmware 22.1s6+/23.0s3+; credited to Nicolas Schaff and the VOC EDF team. — HMS Security Advisory HMSSAR-2026-03-09-001
  • Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00561 (46.9th percentile) as of 2026-11-08. — FIRST EPSS

Check if your firmware is affected

Get a firmware scan reportChat with David on WhatsApp

Related advisories

CVE-2026-28318: SolarWinds Serv-U Unauthenticated Deflate DoS (KEV) — CVSS 7.5, High severityCISA KEVCVE-2026-28318: KEV uncontrolled resource consumption crashes SolarWinds Serv-U via unauthenticated Content-Encoding: deflate POST requests. Sourced to NVD, CISA KEV, SolarWinds.CVE-2026-29063: Immutable.js Prototype Pollution via merge/toJS APIs — CVSS 9.8, Critical severityCVE-2026-29063: NVD-Analyzed prototype pollution in the Immutable.js JavaScript library via mergeDeep(), merge(), Map.toJS() and related APIs. NVD Primary CVSS 9.8, fixed in 3.8.3/4.3.7/5.1.5, not on CISA KEV.CVE-2026-63077: JetBrains TeamCity Agent-Polling Unauthenticated RCE (KEV) — CVSS 9.8, Critical severityCISA KEVCVE-2026-63077: KEV deserialization bug in JetBrains TeamCity's agent polling protocol lets an unauthenticated attacker run OS commands on the CI/CD server. Sourced to NVD, JetBrains, CISA KEV, EPSS.

Sources

  1. NVD
  2. HMS Security Advisory HMSSAR-2026-03-09-001
  3. CISA KEV
  4. FIRST EPSS

Frequently asked questions

What is CVE-2026-25819?

CVE-2026-25819 is a denial-of-service vulnerability (CWE-400) in the web management GUI of HMS Networks' Ewon Flexy and Cosy+ industrial remote-access VPN gateways: an unauthenticated attacker with network access to the device's GUI can send a specially crafted HTTP request that reboots it, and HMS Networks' own advisory rates the flaw 8.7 (high) on CVSS v4.0 when the GUI is exposed to the network, while CISA's vulnerability-enrichment program separately records a CVSS v3.1 score of 7.5; NVD itself has not published a Primary score.

How severe is CVE-2026-25819?

CVE-2026-25819 has no NVD CVSS score published as of 2026-11-10, so this page gives it no severity rating rather than assuming low or high risk.

Is CVE-2026-25819 being actively exploited?

CVE-2026-25819 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. FIRST's EPSS model puts its probability of exploitation at 0.56%.

What is affected by CVE-2026-25819?

CVE-2026-25819 affects HMS Networks Ewon Flexy and Ewon Cosy+ industrial remote-access VPN gateway firmware (web management GUI).

Where does this CVE-2026-25819 information come from?

This advisory is based on NVD, HMS Security Advisory HMSSAR-2026-03-09-001, CISA KEV, and FIRST EPSS, cited in full in the Sources section above.

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp