CVE-2024-33897

A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/	Exploit Third Party Advisory
https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf	Vendor Advisory
https://www.ewon.biz/products/cosy/ewon-cosy-wifi	Product
https://www.hms-networks.com/cyber-security	Not Applicable
http://seclists.org/fulldisclosure/2024/Aug/24
http://seclists.org/fulldisclosure/2024/Aug/27

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:hms-networks:ewon_cosy\+_firmware::::::::
	cpe:2.3:o:hms-networks:ewon_cosy\+_firmware::::::::

OR	cpe:2.3:h:hms-networks:ewon_cosy\+_4g_apac:-:::::::*
	cpe:2.3:h:hms-networks:ewon_cosy\+_4g_eu:-:::::::*
	cpe:2.3:h:hms-networks:ewon_cosy\+_4g_jp:-:::::::*
	cpe:2.3:h:hms-networks:ewon_cosy\+_4g_na:-:::::::*
	cpe:2.3:h:hms-networks:ewon_cosy\+_ethernet:-:::::::*
	cpe:2.3:h:hms-networks:ewon_cosy\+_wifi:-:::::::*

History

No history.

Information

Published : 2024-08-06 14:16

Updated : 2024-11-21 09:17

NVD link : CVE-2024-33897

Mitre link : CVE-2024-33897

CVE.ORG link : CVE-2024-33897

JSON object : View

Products Affected

hms-networks

ewon_cosy\+_4g_na
ewon_cosy\+_4g_apac
ewon_cosy\+_4g_eu
ewon_cosy\+_ethernet
ewon_cosy\+_4g_jp
ewon_cosy\+_firmware
ewon_cosy\+_wifi

CWE

CWE-425

Direct Request ('Forced Browsing')

{"id": "CVE-2024-33897", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2024-08-06T14:16:03.870", "references": [{"url": "https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.ewon.biz/products/cosy/ewon-cosy-wifi", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.hms-networks.com/cyber-security", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2024/Aug/24", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/fulldisclosure/2024/Aug/27", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-425"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-425"}]}], "descriptions": [{"lang": "en", "value": "A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024."}, {"lang": "es", "value": "Un dispositivo HMS Networks Cosy+ comprometido podr\u00eda usarse para solicitar una solicitud de firma de certificado de Talk2m para otro dispositivo, lo que generar\u00eda un problema de disponibilidad. El problema se solucion\u00f3 en el servidor de producci\u00f3n de Talk2m el 18 de abril de 2024."}], "lastModified": "2024-11-21T09:17:41.393", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hms-networks:ewon_cosy\\+_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04E2B00A-5F5D-455D-84DA-4ABFA82A1863", "versionEndExcluding": "21.2s10", "versionStartIncluding": "21.0s0"}, {"criteria": "cpe:2.3:o:hms-networks:ewon_cosy\\+_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1873C613-5DB5-4BFB-A538-860E1BF6555B", "versionEndExcluding": "22.1s3", "versionStartIncluding": "22.0s0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hms-networks:ewon_cosy\\+_4g_apac:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "26AE4359-63AD-4451-AACD-D621B9D422C7"}, {"criteria": "cpe:2.3:h:hms-networks:ewon_cosy\\+_4g_eu:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "95A7AEB3-53A0-4B77-8DFB-8E92E4B24462"}, {"criteria": "cpe:2.3:h:hms-networks:ewon_cosy\\+_4g_jp:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A0C2B08D-D645-4C04-B010-4FF85642F7B5"}, {"criteria": "cpe:2.3:h:hms-networks:ewon_cosy\\+_4g_na:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B85678D5-71F7-47EA-A21F-272BA9C02B33"}, {"criteria": "cpe:2.3:h:hms-networks:ewon_cosy\\+_ethernet:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6F5917C5-AD12-4FB3-9DBB-D757DC053427"}, {"criteria": "cpe:2.3:h:hms-networks:ewon_cosy\\+_wifi:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D1475F50-11AB-4290-8D1D-FFCA2245B0B3"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}