PT-2026-25078 · Undefined · Undefined

Published 2026-03-12 · Updated 2026-03-14 · CVE-2026-25817

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HMS Networks Ewon Flexy versions prior to 15.0s4 HMS Networks Ewon Cosy+ versions 22.xx prior to 22.1s6 HMS Networks Ewon Cosy+ versions 23.xx prior to 23.0s3

Description The software contains improper neutralization of special elements used in an OS command, which could allow remote code execution. An attacker with low privilege access on the gateway, who has credentials, can exploit this issue.

Recommendations Update HMS Networks Ewon Flexy to version 15.0s4 or later. Update HMS Networks Ewon Cosy+ to version 22.1s6 or later. Update HMS Networks Ewon Cosy+ to version 23.0s3 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-25817

Affected Products

Undefined

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-25817 · Security Note
• https://twitter.com/CveFindCom/status/2032550504677446137 · Twitter Post
• https://twitter.com/CVEnew/status/2032410982333730869 · Twitter Post
• https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2026-03-09-001---ewon-several-flexy-and-cosy--vulnerabilities.pdf?sfvrsn=f7c027b8_13 · Note
• https://twitter.com/TheHackerWire/status/2032870143936917623 · Twitter Post
• https://hms-networks.com/p/flexy20500-00ma-ewon-flexy-205 · Note