CVEvulnerability

CVE-2025-41733

9.8 CRITICAL Published 2025-11-18 Modified 2026-10-18 Official page ↗
Status
Analyzed
Published
2025-11-18
Last modified
2026-10-18
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-305

Description

The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.

Affected configurations

• metz-connect ewio2-m firmware (< 2.2.0) • metz-connect ewio2-m-bm firmware (< 2.2.0) • metz-connect ewio2-bm firmware (< 2.2.0)

Related

Weakness · CWE (1)

  • CWE-305 Authentication Bypass by Primary Weakness weakness

References