Vulnerability Details CVE-2020-10633
A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can be successful.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 53.5%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
References
Products affected by CVE-2020-10633
-
cpe:2.3:h:hms-networks:ewon_cosy:-
-
cpe:2.3:h:hms-networks:ewon_flexy:-
-
cpe:2.3:o:hms-networks:ewon_cosy_firmware:-
-
cpe:2.3:o:hms-networks:ewon_cosy_firmware:14.1
-
cpe:2.3:o:hms-networks:ewon_flexy_firmware:-
-
cpe:2.3:o:hms-networks:ewon_flexy_firmware:14.1