CVE-2025-41733
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-18

Last updated on: 2025-11-21

Assigner: CERT VDE

Description
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-18
Last Modified
2025-11-21
Generated
2026-06-16
AI Q&A
2025-11-18
EPSS Evaluated
2026-06-15
NVD
CVE-2025-41733
EUVD
EUVD-2025-197985
Affected Vendors & Products
Showing 6 associated CPEs
Vendor Product Version / Range
metz-connect ewio2-m_firmware to 2.2.0 (exc)
metz-connect ewio2-m *
metz-connect ewio2-m-bm_firmware to 2.2.0 (exc)
metz-connect ewio2-m-bm *
metz-connect ewio2-bm_firmware to 2.2.0 (exc)
metz-connect ewio2-bm *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-305 The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists because the commissioning wizard on the affected devices does not check whether the device has already been initialized. This flaw allows an unauthenticated remote attacker to send specially crafted POST requests to set root credentials on the device, potentially gaining full control.

Impact Analysis

An attacker exploiting this vulnerability can gain root access to the affected device without authentication. This can lead to complete compromise of the device, including unauthorized access, data theft, manipulation, or disruption of device functionality.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-41733. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart