CVE-2024-33894

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-33894
Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are executing several processes with elevated privileges.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/ Exploit Third Party Advisory
https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf Vendor Advisory
https://www.ewon.biz/products/cosy/ewon-cosy-wifi Product
https://www.hms-networks.com/cyber-security Vendor Advisory
http://seclists.org/fulldisclosure/2024/Aug/23 Exploit Mailing List
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:hms-networks:ewon_cosy\+_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:hms-networks:ewon_cosy\+_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:hms-networks:ewon_cosy\+_4g_apac:-:*:*:*:*:*:*:*
cpe:2.3:h:hms-networks:ewon_cosy\+_4g_eu:-:*:*:*:*:*:*:*
cpe:2.3:h:hms-networks:ewon_cosy\+_4g_jp:-:*:*:*:*:*:*:*
cpe:2.3:h:hms-networks:ewon_cosy\+_4g_na:-:*:*:*:*:*:*:*
cpe:2.3:h:hms-networks:ewon_cosy\+_ethernet:-:*:*:*:*:*:*:*
cpe:2.3:h:hms-networks:ewon_cosy\+_wifi:-:*:*:*:*:*:*:*
History

20 Jun 2025, 18:10

Type Values Removed Values Added
First Time Hms-networks ewon Cosy\+ 4g Apac
Hms-networks ewon Cosy\+ Wifi
Hms-networks
Hms-networks ewon Cosy\+ Ethernet
Hms-networks ewon Cosy\+ 4g Jp
Hms-networks ewon Cosy\+ Firmware
Hms-networks ewon Cosy\+ 4g Na
Hms-networks ewon Cosy\+ 4g Eu
CPE cpe:2.3:h:hms-networks:ewon_cosy\+_4g_na:-:*:*:*:*:*:*:*
cpe:2.3:h:hms-networks:ewon_cosy\+_4g_jp:-:*:*:*:*:*:*:*
cpe:2.3:h:hms-networks:ewon_cosy\+_wifi:-:*:*:*:*:*:*:*
cpe:2.3:o:hms-networks:ewon_cosy\+_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hms-networks:ewon_cosy\+_4g_eu:-:*:*:*:*:*:*:*
cpe:2.3:h:hms-networks:ewon_cosy\+_ethernet:-:*:*:*:*:*:*:*
cpe:2.3:h:hms-networks:ewon_cosy\+_4g_apac:-:*:*:*:*:*:*:*
References () https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/ - () https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/ - Exploit, Third Party Advisory
References () https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf - () https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf - Vendor Advisory
References () https://www.ewon.biz/products/cosy/ewon-cosy-wifi - () https://www.ewon.biz/products/cosy/ewon-cosy-wifi - Product
References () https://www.hms-networks.com/cyber-security - () https://www.hms-networks.com/cyber-security - Vendor Advisory
References () http://seclists.org/fulldisclosure/2024/Aug/23 - () http://seclists.org/fulldisclosure/2024/Aug/23 - Exploit, Mailing List

21 Nov 2024, 09:17

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2024/Aug/23 -

12 Aug 2024, 16:15

Type Values Removed Values Added
References
  • () https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/ -

05 Aug 2024, 16:35

Type Values Removed Values Added
CWE CWE-269
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

05 Aug 2024, 12:41

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de permiso inseguro en dispositivos Cosy+ que ejecutan un firmware 21.x inferior a 21.2s10 o un firmware 22.x inferior a 22.1s3 están ejecutando varios procesos con privilegios elevados.

02 Aug 2024, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-02 18:16

Updated : 2025-06-20 18:10

NVD link : CVE-2024-33894

Mitre link : CVE-2024-33894

CVE.ORG link : CVE-2024-33894

JSON object : View

Products Affected

hms-networks

  • ewon_cosy\+_4g_eu
  • ewon_cosy\+_firmware
  • ewon_cosy\+_ethernet
  • ewon_cosy\+_4g_apac
  • ewon_cosy\+_4g_na
  • ewon_cosy\+_wifi
  • ewon_cosy\+_4g_jp
CWE
CWE-269

Improper Privilege Management