BaseFortify

Publication date: 2025-11-18

Last updated on: 2025-11-21

Assigner: CERT VDE

Description

The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-18

Last Modified

2025-11-21

Generated

2026-07-06

AI Q&A

2025-11-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-41733

EUVD

EUVD-2025-197985

Affected Vendors & Products

Vendor	Product	Version / Range
metz-connect	ewio2-m_firmware	to 2.2.0 (exc)
metz-connect	ewio2-m	*
metz-connect	ewio2-m-bm_firmware	to 2.2.0 (exc)
metz-connect	ewio2-m-bm	*
metz-connect	ewio2-bm_firmware	to 2.2.0 (exc)
metz-connect	ewio2-bm	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-305	The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Attack-Flow Graph

Executive Summary

This vulnerability exists because the commissioning wizard on the affected devices does not check whether the device has already been initialized. This flaw allows an unauthenticated remote attacker to send specially crafted POST requests to set root credentials on the device, potentially gaining full control.

Impact Analysis

An attacker exploiting this vulnerability can gain root access to the affected device without authentication. This can lead to complete compromise of the device, including unauthorized access, data theft, manipulation, or disruption of device functionality.

Hi! I’m here to help you understand CVE-2025-41733. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70