CVE-2025-41733

The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-25)

CWE

CWE-305

Published

2025-11-18

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• metz-connect:ewio2-bm_firmware
• metz-connect:ewio2-m-bm_firmware
• metz-connect:ewio2-m_firmware

References

• https://certvde.com/de/advisories/VDE-2025-097

Check your stackJSON