A critical OS command injection vulnerability in HMS Networks Ewon Flexy and Cosy+ gateways allows low-privileged attackers to execute arbitrary code, posing a severe risk of unauthorized system control.

This is an OS command injection flaw (CWE-78) resulting from improper neutralization of special elements. The vulnerability allows an attacker who already possesses low-privileged credentials to gain remote code execution on the affected gateway device.

The ability for a low-privileged user to execute arbitrary OS commands presents a significant risk to industrial and remote access infrastructure. Successful exploitation could lead to full system compromise, loss of confidentiality and integrity, and potential disruption of critical operational technology services. Given the CVSS score of 8.8, this vulnerability is categorized as High severity, reflecting the high impact of unauthorized remote command execution.

Immediate Action: Update all affected Ewon Flexy and Cosy+ devices to the latest firmware versions provided by HMS Networks (version 15.0s4 or later for Flexy, 22.1s6 or later for Cosy+ 22.xx, and 23.0s3 or later for Cosy+ 23.xx).

Proactive Monitoring: Review device access logs for unusual command execution patterns or attempts to access administrative functions by low-privileged user accounts.

Compensating Controls: Restrict network access to the management interfaces of these devices to trusted management subnets only, and enforce strict credential management to prevent unauthorized access by potentially compromised user accounts.

Public Exploit Available: No — exploit_available (unknown).

Organizations utilizing HMS Networks Ewon Flexy or Cosy+ gateways must prioritize the application of firmware updates to mitigate the risk of remote code execution. Because this vulnerability allows an authenticated attacker to gain full control over the gateway, immediate patching is necessary to secure the integrity of the connected network and industrial assets.