CVE-2024-33894

HIGH EPSS 53.5%
Published Aug 2, 20241y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Aug 2, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are executing several processes with elevated privileges.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
53.5% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-269 Improper Privilege Management Authorization

Affected Products 8

VendorProductVersionRange
hms-networksewon_cosy\+_firmware*≥21.0s0  –  <21.2s10
hms-networksewon_cosy\+_firmware*≥22.0s0  –  <22.1s3
hms-networksewon_cosy\+_4g_apac*any
hms-networksewon_cosy\+_4g_eu*any
hms-networksewon_cosy\+_4g_jp*any
hms-networksewon_cosy\+_4g_na*any
hms-networksewon_cosy\+_ethernet*any
hms-networksewon_cosy\+_wifi*any

References 5

  • seclists.org http://seclists.org/fulldisclosure/2024/Aug/23
    ExploitMailing List
  • blog.syss.com https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/
    ExploitThird Party Advisory
  • hmsnetworks.blob.core.windows.net https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf
    Vendor Advisory
  • ewon.biz https://www.ewon.biz/products/cosy/ewon-cosy-wifi
    Product
  • hms-networks.com https://www.hms-networks.com/cyber-security
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.