What’s Vulnerable › Vulnerabilities

CVE-2020-16230

• Severity: low (CVSS 2.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-09-18 · updated 2026-06-17

Description

All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing (CORS) configuration that could abuse this vulnerability, allowing the attacker to retrieve limited confidential information through sniffing.

Affected products

• Hms-Networks Ewon Cosy Firmware: before 14.1 — fixed in 14.1
• Hms-Networks Ewon Flexy Firmware: before 14.1 — fixed in 14.1

How to fix

Upgrade to a fixed version: Hms-Networks Ewon Cosy Firmware 14.1; Hms-Networks Ewon Flexy Firmware 14.1. Check the vendor advisory for mitigations.

References

• https://us-cert.cisa.gov/ics/advisories/icsa-20-254-03
• https://us-cert.cisa.gov/ics/advisories/icsa-20-254-03

Get alerted when CVE-2020-16230 or the next vulnerability affects your stack