CVE-2026-25819: HMS Ewon Flexy/Cosy+ DoS Vulnerability

CVE-2026-25819 Overview

CVE-2026-25819 is a denial of service vulnerability affecting HMS Networks Ewon Flexy and Cosy+ industrial remote access gateways. Unauthenticated attackers with network access to the device's graphical user interface (GUI) can send a specially crafted HTTP request that forces the device to reboot. The flaw is classified under CWE-400 for uncontrolled resource consumption. Affected versions include Ewon Flexy firmware prior to 15.0s4, Cosy+ firmware 22.xx prior to 22.1s6, and Cosy+ firmware 23.xx prior to 23.0s3. The vulnerability impacts operational technology environments where these gateways provide remote connectivity to industrial equipment.

Critical Impact
Unauthenticated network attackers can reboot affected Ewon Flexy and Cosy+ devices via a crafted HTTP request, disrupting industrial remote access and connected operational technology workflows.

Affected Products

HMS Networks Ewon Flexy with firmware before 15.0s4
HMS Networks Ewon Cosy+ with firmware 22.xx before 22.1s6
HMS Networks Ewon Cosy+ with firmware 23.xx before 23.0s3

Discovery Timeline

2026-03-13 - CVE-2026-25819 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-25819

Vulnerability Analysis

The vulnerability resides in the HTTP request handling logic of the device's GUI service. A specially crafted HTTP request triggers a fault condition that causes the device to reboot. Because the GUI accepts the request without requiring authentication, any attacker who can reach the GUI over the network can trigger the condition. The result is a complete service interruption for the duration of the reboot cycle, with potential cascading impact on connected industrial assets that rely on the gateway for connectivity. Repeated requests can sustain the denial of service condition indefinitely.

Root Cause

The root cause is uncontrolled resource consumption ([CWE-400]) in the HTTP request processing path. The affected firmware fails to validate or constrain input contained in the crafted request before routing it through the GUI handler. This input causes an unrecoverable state in the device, which responds by rebooting rather than gracefully rejecting the malformed request.

Attack Vector

Exploitation requires network access to the device's GUI but no credentials, no user interaction, and low attack complexity. An attacker positioned on the same network segment, or able to reach the GUI through routed access or exposed management interfaces, can issue the HTTP request directly. Devices exposed to the internet are at the highest risk. No public proof-of-concept code has been released according to the vendor advisory.

For specific technical details of the malformed request structure, refer to the HMS Networks Security Advisory.

Detection Methods for CVE-2026-25819

Indicators of Compromise

Unexpected reboot events recorded in device logs without a corresponding administrator action or scheduled maintenance window.
Loss of management connectivity or remote access sessions to industrial equipment behind the Flexy or Cosy+ gateway.
Inbound HTTP requests to the gateway GUI from untrusted or unexpected source addresses.

Detection Strategies

Monitor device uptime and reboot counters via vendor management tooling and alert on anomalous restart patterns.
Inspect network flow records for repeated HTTP requests targeting the GUI port on Flexy and Cosy+ devices.
Correlate gateway reboots with upstream HTTP traffic to identify probable triggering requests.

Monitoring Recommendations

Centralize syslog and device telemetry from Ewon gateways into a SIEM for continuous monitoring of restart events.
Track running firmware versions across the fleet and flag any devices below 15.0s4, 22.1s6, or 23.0s3.
Alert on any new exposure of Ewon GUI services to untrusted networks or the public internet.

How to Mitigate CVE-2026-25819

Immediate Actions Required

Upgrade Ewon Flexy devices to firmware 15.0s4 or later.
Upgrade Cosy+ devices on the 22.xx branch to 22.1s6 or later, and on the 23.xx branch to 23.0s3 or later.
Restrict network access to the device GUI to trusted management networks only.
Audit perimeter firewalls and remote access policies to confirm no Ewon GUI is reachable from the internet.

Patch Information

HMS Networks has released fixed firmware versions addressing this vulnerability. Refer to the HMS Networks Security Advisory for download links and upgrade procedures. Product information is available on the HMS Networks Product Page.

Workarounds

Place affected devices behind a firewall and allow GUI access only from authorized administrative hosts.
Disable the GUI service on devices where it is not required for ongoing operations.
Apply network segmentation to isolate industrial gateways from general corporate and untrusted networks.

bash

# Configuration example: restrict GUI access with an upstream firewall rule
# Replace 10.10.0.0/24 with your authorized management subnet
# and 192.0.2.10 with the Ewon device IP address

iptables -A FORWARD -p tcp -s 10.10.0.0/24 -d 192.0.2.10 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -s 10.10.0.0/24 -d 192.0.2.10 --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 -j DROP