VulnerabilityPublished 12 Mar 2026Updated 13 Mar 2026

CVE-2026-25818: a Cookie · Cleartext Storage of Sensitive Information

Source CVE Database V5

Not known to be exploited · CVSS 9.1 Critical.

Data as of 27 Oct 2026, 05:11 UTC

CVSS 3.1 base score

9.1Critical

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 12 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Organizations should immediately inventory their HMS Networks Ewon Flexy and Cosy+ devices to identify affected firmware versions. Until patches are released, implement network segmentation to isolate these devices from general IT networks and restrict access to trusted administrators only. Enforce strong monitoring of network traffic for anomalous session cookie usage or brute-force attempts. Employ multi-factor authentication where possible to reduce reliance on password secrecy alone. Use VPNs or secure tunnels with additional encryption layers to protect session data in transit. Regularly rotate user credentials and invalidate session cookies after short durations to limit exposure. Coordinate closely with HMS Networks for timely firmware updates and apply patches as soon as they become available. Conduct security awareness training for staff managing these devices to recognize potential indicators of compromise. Consider deploying intrusion detection systems tailored to industrial protocols to detect exploitation attempts early.

Description

CVE-2026-25818 affects HMS Networks Ewon Flexy and Cosy+ devices with certain firmware versions, where weak entropy in authentication cookies enables attackers possessing a stolen session cookie to brute-force encryption parameters and recover user passwords. This vulnerability does not require user interaction or privileges and can be exploited remotely over the network. The flaw impacts confidentiality and integrity but not availability. It has a critical CVSS score of 9.1 due to ease of exploitation and high impact. No known exploits are currently in the wild, but the vulnerability poses a significant risk to industrial and remote access systems relying on these devices. Organizations using affected firmware versions should prioritize patching once updates are available and implement compensating controls to protect session cookies. Countries with significant industrial automation and remote monitoring deployments of HMS Networks products are most at risk.

Impact

The vulnerability poses a critical risk to organizations using HMS Networks Ewon Flexy and Cosy+ devices, especially in industrial automation, manufacturing, and remote monitoring environments. Successful exploitation allows attackers to recover user passwords from stolen session cookies, leading to unauthorized access to sensitive control systems. This can result in data breaches, manipulation of industrial processes, and potential disruption of operational technology environments. The compromise of authentication credentials undermines trust in remote access security and can facilitate lateral movement within networks. Given the devices’ role in critical infrastructure and industrial control systems, the impact extends beyond IT to operational technology, increasing the risk of physical damage or safety incidents. The lack of required privileges or user interaction lowers the barrier for attackers, increasing the likelihood of exploitation. Organizations worldwide relying on these devices face potential exposure to espionage, sabotage, or ransomware attacks targeting industrial environments.

CWE-315Cleartext Storage of Sensitive Information in a Cookie (opens in a new tab)
Variant weaknessOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
The product stores sensitive information in cleartext in a cookie.
OWASP ASVS 4.0.3
V8.1.6 (opens in a new tab)
V8.2.3 (opens in a new tab)
V8.2.2 (opens in a new tab)
Attack patterns
Accessing/Intercepting/Modifying HTTP Cookies (opens in a new tab)
Retrieve Embedded Sensitive Data (opens in a new tab)
Manipulating Opaque Client-based Data Tokens (opens in a new tab)
Manipulating State (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 20 Mar 2026, 02:42 UTC

WeaknessesCWE-315

Technical details

References

Community reviews

Related threats