CVE-2025-41733

critical · 9.8

The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.

9.8

CVSS

0.6%

EPSS (exploit prob.)

49th

EPSS percentile

2025-11-18

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-305

Affected products

Vendor	Product	Affected versions
metz-connect	ewio2-m_firmware	< 2.2.0
metz-connect	ewio2-m	all versions
metz-connect	ewio2-m-bm_firmware	< 2.2.0
metz-connect	ewio2-m-bm	all versions
metz-connect	ewio2-bm_firmware	< 2.2.0
metz-connect	ewio2-bm	all versions

Check a specific version with /api/v1/cve/match.

References

https://certvde.com/de/advisories/VDE-2025-097

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-41733