PT-2024-25532 · Cosy+ · Cosy+

Published 2024-08-02 · Updated 2024-09-03 · CVE-2024-33895

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cosy+ devices versions 21.x below 21.2s10 Cosy+ devices versions 22.x below 22.1s3

Description The issue concerns the use of a unique key for encrypting configuration parameters in Cosy+ devices. This key is not unique per device in affected versions, which poses a security risk. The problem is fixed in versions 21.2s10 and 22.1s3, where the key is now unique per device.

Recommendations For Cosy+ devices versions 21.x below 21.2s10, update to version 21.2s10 to fix the issue. For Cosy+ devices versions 22.x below 22.1s3, update to version 22.1s3 to fix the issue.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2024-33895

Affected Products

Cosy+

References · 13

• 🔥 https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway · Exploit
• https://osv.dev/vulnerability/CVE-2024-33895 · Vendor Advisory
• https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-33895 · Security Note
• https://hms-networks.com/cyber-security · Vendor Advisory
• https://t.me/cvedetector/2370 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Aug/22 · Note
• https://t.me/cvenotify/93085 · Telegram Post
• https://twitter.com/ksg93rd/status/1826288975772037482 · Twitter Post
• https://t.me/cybersecuritytechnologies/11017 · Telegram Post
• https://twitter.com/buaqbot/status/1825068890277150920 · Twitter Post
• https://t.me/cvenotify/90138 · Telegram Post
• https://ewon.biz/products/cosy/ewon-cosy-wifi · Note