CVE-2024-33897

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-08-06 · updated 2026-06-17
Weakness: CWE-425

Description

A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024.

Affected products

Hms-Networks Ewon Cosy+ Firmware: from 21.0s0 before 21.2s10; from 22.0s0 before 22.1s3 — fixed in 21.2s10, 22.1s3

How to fix

Upgrade to a fixed version: Hms-Networks Ewon Cosy+ Firmware 21.2s10, 22.1s3. Check the vendor advisory for mitigations.

References

https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/
https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf
https://www.ewon.biz/products/cosy/ewon-cosy-wifi
https://www.hms-networks.com/cyber-security
http://seclists.org/fulldisclosure/2024/Aug/24
http://seclists.org/fulldisclosure/2024/Aug/27

Get alerted when CVE-2024-33897 or the next vulnerability affects your stack