CVE-2020-10633 | BDVDB-2026-133756 Detail

eWON Flexy and Cosy

Description#

A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can be successful.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://www.us-cert.gov/ics/advisories/icsa-20-098-03

Exploit#

No public exploit known

History#

Version 12020-04-08Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.