PT-2025-3886 · Hms Industrial Networks · Ewon Flexy 202

Dr. Faruk Kazi + 2 · Published 2025-01-28 · Updated 2025-02-05 · CVE-2025-0432

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions EWON Flexy 202 (affected versions not specified)

Description The issue concerns the transmission of user credentials in clear text without encryption when a user is added or user credentials are changed via the device's webpage. This affects the security of user credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2025-0432

Affected Products

Ewon Flexy 202

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-0432 · Security Note
• https://hms-networks.com/cyber-security · Note
• https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/ewon/manuals-and-guides---installation-guides/best-practices-for-a-secure-usage-of-the-ewon-solution-en.pdf?sfvrsn=37160847_4 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-25-023-06 · Note
• https://twitter.com/CVEnew/status/1884274377765564893 · Twitter Post
• https://t.me/cvedetector/16613 · Telegram Post
• https://twitter.com/transilienceai/status/1886933901672898956 · Twitter Post
• https://twitter.com/transilienceai/status/1886880105575620828 · Twitter Post
• https://support.hms-networks.com/hc/en-us/articles/19393244940818-How-to-block-all-the-unused-Ewon-Flexy-Cosy131-services-on-the-LAN-WAN-and-or-VPN-interface · Note