PT-2024-25530 · Cosy+ · Cosy+

Moritz Abrell · Published 2024-08-02 · Updated 2024-10-31 · CVE-2024-33893

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cosy+ devices versions 21.x through 21.2s9 Cosy+ devices versions 22.x through 22.1s2

Description The issue arises from improper input sanitization when displaying logs, leading to a potential XSS attack. This is due to the improper neutralization of input during web page generation. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For Cosy+ devices versions 21.x through 21.2s9, update to version 21.2s10 to resolve the issue. For Cosy+ devices versions 22.x through 22.1s2, update to version 22.1s3 to resolve the issue. As a temporary workaround, consider restricting access to the log display feature until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-33893

Affected Products

Cosy+

References · 12

• 🔥 https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway · Exploit
• https://osv.dev/vulnerability/CVE-2024-33893 · Vendor Advisory
• https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-33893 · Security Note
• https://hms-networks.com/cyber-security · Vendor Advisory
• https://t.me/cvenotify/90136 · Telegram Post
• https://t.me/cvedetector/2371 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Aug/22 · Note
• https://t.me/cvenotify/93084 · Telegram Post
• https://twitter.com/buaqbot/status/1825068886892441926 · Twitter Post
• http://seclists.org/fulldisclosure/2024/Aug/19 · Note
• https://ewon.biz/products/cosy/ewon-cosy-wifi · Note