PT-2024-39458 · Hms Networks · Ewon Flexy 205

T. Fankhauser + 1 · Published 2024-12-19 · Updated 2024-12-22 · CVE-2024-9154

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ewon Flexy 205 versions through 14.8s0

Description A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device.

Recommendations For Ewon Flexy 205 versions through 14.8s0, update to a version later than 14.8s0 to resolve the issue. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-9154

Affected Products

Ewon Flexy 205

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-9154 · Security Note
• https://twitter.com/CVEnew/status/1869778661508776115 · Twitter Post
• https://t.me/cvedetector/13339 · Telegram Post
• https://cyberdanube.com/security-research/authenticated-remote-code-execution-in-ewon-flexy-205 · Note
• https://twitter.com/CveFindCom/status/1869775482750693420 · Twitter Post
• http://seclists.org/fulldisclosure/2024/Dec/18 · Note
• https://t.me/cvenotify/105248 · Telegram Post
• https://twitter.com/VIPER92929/status/1870765252499079269 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1869785843377827931 · Twitter Post