CVE-2024-33894
📋 TL;DR
Cosy+ industrial remote access gateways running vulnerable firmware versions execute multiple processes with excessive privileges, allowing attackers to escalate privileges and potentially gain full system control. This affects organizations using Cosy+ devices for industrial network connectivity with firmware versions 21.x below 21.2s10 or 22.x below 22.1s3.
💻 Affected Systems
- Ewon Cosy+ industrial remote access gateways
📦 What is this software?
Ewon Cosy\+ Firmware by Hms Networks
Ewon Cosy\+ Firmware by Hms Networks
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Cosy+ device leading to lateral movement into industrial control systems, data exfiltration, or disruption of industrial operations.
Likely Case
Privilege escalation allowing attackers to execute arbitrary code, modify device configuration, or establish persistent access to industrial networks.
If Mitigated
Limited impact if devices are isolated from internet and internal networks have strict segmentation with proper access controls.
🎯 Exploit Status
Exploitation requires initial access to the device (typically via web interface or SSH), after which privilege escalation is straightforward. Technical details and proof-of-concept code are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware 21.2s10 or 22.1s3 and later
Restart Required: Yes
Instructions:
1. Download latest firmware from HMS Networks/Ewon support portal. 2. Backup current configuration. 3. Upload firmware via web interface. 4. Apply firmware update. 5. Reboot device. 6. Restore configuration if needed.
🔧 Temporary Workarounds
Network isolation
allIsolate Cosy+ devices from internet and restrict network access to only necessary systems
Access control hardening
allImplement strict authentication policies, disable unnecessary services, and use VPN for remote access instead of direct device exposure
🧯 If You Can't Patch
- Implement network segmentation to isolate Cosy+ devices from critical industrial systems
- Deploy intrusion detection systems to monitor for privilege escalation attempts and unusual process behavior
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System > About) or SSH connection and compare against vulnerable versionsCheck Version:
ssh admin@device_ip 'cat /etc/version' or check web interface System > About pageVerify Fix Applied:
Confirm firmware version is 21.2s10 or higher for 21.x branch, or 22.1s3 or higher for 22.x branch📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts
- Multiple processes running with root privileges
- Unauthorized configuration changes
Network Indicators:
- Unexpected outbound connections from Cosy+ devices
- Unusual SSH or web interface access patterns
SIEM Query:
source="cosy+_logs" AND (event_type="privilege_escalation" OR process_name="unexpected_process" running_as="root")🔗 References
- https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/
- https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf
- https://www.ewon.biz/products/cosy/ewon-cosy-wifi
- https://www.hms-networks.com/cyber-security
- http://seclists.org/fulldisclosure/2024/Aug/23
