CVE-2024-33893
📋 TL;DR
Cosy+ industrial remote access gateways running vulnerable firmware versions are susceptible to cross-site scripting (XSS) attacks when displaying logs due to improper input sanitization. This allows attackers to inject malicious scripts that execute in the context of legitimate users' browsers. Organizations using affected Cosy+ devices for industrial control system remote access are impacted.
💻 Affected Systems
- Ewon Cosy+ industrial remote access gateways
📦 What is this software?
Ewon Cosy\+ Firmware by Hms Networks
Ewon Cosy\+ Firmware by Hms Networks
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, hijack sessions, redirect users to malicious sites, or perform actions on the device with the victim's privileges, potentially compromising industrial control systems.
Likely Case
Attackers inject malicious scripts to steal session cookies or credentials, enabling unauthorized access to the Cosy+ device management interface.
If Mitigated
With proper network segmentation and access controls, impact is limited to the management interface of the affected device only.
🎯 Exploit Status
Exploitation requires the attacker to have access to inject malicious content into logs or trick users into viewing crafted log entries. Detailed technical analysis is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 21.2s10 or 22.1s3
Restart Required: Yes
Instructions:
1. Download firmware update from HMS Networks/Ewon support portal. 2. Backup device configuration. 3. Upload firmware via web interface. 4. Apply update and restart device. 5. Verify firmware version after reboot.
🔧 Temporary Workarounds
Restrict access to management interface
allLimit access to Cosy+ web interface to trusted IP addresses only using firewall rules.
Disable unnecessary log viewing
allRestrict user permissions to prevent access to log viewing functionality if not required.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Cosy+ devices from untrusted networks
- Deploy web application firewall (WAF) with XSS protection rules in front of Cosy+ management interface
🔍 How to Verify
Check if Vulnerable:
Access Cosy+ web interface, navigate to System > About, check firmware version against affected ranges.Check Version:
No CLI command available. Check via web interface at System > About page.Verify Fix Applied:
After updating, verify firmware version shows 21.2s10 or higher for 21.x branch, or 22.1s3 or higher for 22.x branch.📡 Detection & Monitoring
Log Indicators:
- Unusual log entries containing script tags or JavaScript code
- Multiple failed login attempts followed by successful login from new IP
Network Indicators:
- HTTP requests to Cosy+ interface containing script injection patterns
- Outbound connections from Cosy+ device to unexpected external domains
SIEM Query:
source="cosy_logs" AND (message="<script" OR message="javascript:" OR message="onerror=" OR message="onload=")🔗 References
- https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/
- https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf
- https://www.ewon.biz/products/cosy/ewon-cosy-wifi
- https://www.hms-networks.com/cyber-security
- http://seclists.org/fulldisclosure/2024/Aug/19
- http://seclists.org/fulldisclosure/2024/Aug/22
