CVE-2025-41733 - CVE House

Status published Critical CVE-2025-41733

Possible malfunction credential injection

9.8 CVSS

Vulnerability Description

The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-41733

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Noam Moshe from Claroty Team82
Tomer Goldschmidt from Claroty Team82

References

https://certvde.com/de/advisories/VDE-2025-097

More from METZ CONNECT

View All →

CVE-2025-41737

Improper access control via php endpoint

High 7.5

CVE-2025-41736

Possible arbitrary code execution

High 8.8

CVE-2025-41735

Possible arbitrary file upload

High 8.8

CVE-2025-41734

Unauthenticated Local File Inclusion in php module

Critical 9.8

Affected Vendor

METZ CONNECT

View all reports →

Affected Software

Energy-Controlling EWIO2-M, Energy-Controlling EWIO2-M-BM, Ethernet-IO EWIO2-BM

Vulnerable Versions:

0.0.0

Timeline

Official Publish: November 18th, 2025

Last Modified: November 18th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-305

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.