CVE-2020-10633CWE-79

A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0)

published April 8, 2020

CVSS
—
EPSS
1%
Percentile
52.1
In the wild
Unconfirmed
What it is

A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can be successful.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00687 · 52.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-04-08T00:03Z
EPSS history
Timeline
  • 08 APR 00:03Z
    A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0)
    cvelistv5