CVE-2024-33896
📋 TL;DR
CVE-2024-33896 is a code injection vulnerability in Cosy+ industrial remote access gateways that allows attackers to execute arbitrary commands on affected devices. This affects organizations using Cosy+ devices with vulnerable firmware versions, potentially compromising industrial control systems and operational technology networks.
💻 Affected Systems
- Ewon Cosy+ industrial remote access gateways
📦 What is this software?
Ewon Cosy\+ Firmware by Hms Networks
Ewon Cosy\+ Firmware by Hms Networks
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to industrial process disruption, data exfiltration, lateral movement into OT networks, and physical safety risks in critical infrastructure.
Likely Case
Unauthorized access to device configuration, credential theft, network reconnaissance, and potential ransomware deployment in industrial environments.
If Mitigated
Limited impact with proper network segmentation, but still potential for device compromise if perimeter defenses are breached.
🎯 Exploit Status
Detailed exploit techniques published in security advisories and blog posts. Attack requires network access to vulnerable device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 21.2s10 for 21.x branch, 22.1s3 for 22.x branch
Restart Required: Yes
Instructions:
1. Download latest firmware from HMS Networks/Ewon portal. 2. Backup device configuration. 3. Upload firmware via web interface. 4. Apply update. 5. Reboot device. 6. Verify firmware version.
🔧 Temporary Workarounds
Network segmentation and access control
allIsolate Cosy+ devices in dedicated network segments with strict firewall rules
Disable unnecessary services
allTurn off unused network services and interfaces on Cosy+ devices
🧯 If You Can't Patch
- Implement strict network access controls allowing only authorized IP addresses
- Monitor network traffic to/from Cosy+ devices for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: Login > System > About. Compare version against vulnerable ranges.Check Version:
Web interface navigation or check device documentation for CLI access methodsVerify Fix Applied:
Confirm firmware version shows 21.2s10 or higher for 21.x branch, or 22.1s3 or higher for 22.x branch📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts
- Unexpected configuration changes
- Command execution logs showing suspicious patterns
Network Indicators:
- Unexpected outbound connections from Cosy+ devices
- Traffic to known malicious IPs
- Anomalous protocol usage
SIEM Query:
source="cosy+*" AND (event_type="command_execution" OR event_type="configuration_change") | stats count by src_ip, user🔗 References
- https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/
- https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf
- https://www.ewon.biz/products/cosy/ewon-cosy-wifi
- https://www.hms-networks.com/cyber-security
- http://seclists.org/fulldisclosure/2024/Aug/21
