CVE-2026-25819 Denial of service in n/a
Unauthenticated attackers can cause a device reboot via crafted HTTP requests to the GUI, impacting availability of HMS Networks Ewon and Cosy+ devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25819?
CVE-2026-25819 is a high-severity denial of service vulnerability in n/a, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 allows unauthenticated attackers to cause a Denial of Service by using a specially crafted HTTP request that leads to a reboot of the device, provided they have access to the device's GUI.
Weakness: CWE-400
Which versions are affected by CVE-2026-25819?
How do I fix CVE-2026-25819?
No fix has been published for CVE-2026-25819 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-25819 being exploited?
There is no known exploitation of CVE-2026-25819 in the wild and no public exploit code.
Sources
Also known as GHSA-hwx3-r9g9-2q2v.