PT-2026-25079 · Undefined · Undefined

Published 2026-03-12 · Updated 2026-03-14 · CVE-2026-25818

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HMS Networks Ewon Flexy versions prior to 15.0s4 HMS Networks Ewon Cosy+ versions 22.xx prior to 22.1s6 HMS Networks Ewon Cosy+ versions 23.xx prior to 23.0s3

Description The affected devices have weak entropy for authentication cookies. This allows an attacker who obtains a session cookie to potentially determine the user password through brute-forcing an encryption parameter.

Recommendations Update HMS Networks Ewon Flexy to version 15.0s4 or later. Update HMS Networks Ewon Cosy+ to version 22.1s6 or later. Update HMS Networks Ewon Cosy+ to version 23.0s3 or later.

Fix

Weakness Enumeration

CWE-315

Related Identifiers

CVE-2026-25818

Affected Products

Undefined

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-25818 · Security Note
• https://twitter.com/TheHackerWire/status/2032864340316139824 · Twitter Post
• https://twitter.com/CVEnew/status/2032410983222915300 · Twitter Post
• https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2026-03-09-001---ewon-several-flexy-and-cosy--vulnerabilities.pdf?sfvrsn=f7c027b8_13 · Note
• https://hms-networks.com/p/flexy20500-00ma-ewon-flexy-205 · Note
• https://twitter.com/CveFindCom/status/2032550554480611593 · Twitter Post