CVE-2025-41733

Critical CVSS: 9.8

The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.

Vendor

Metz-connect

Product

Ewio2-m Firmware

CWE

CWE-305

Yayın Tarihi

2025-11-18 11:15:46

Güncelleme

2025-11-21 19:14:52

Source Identifier

info@cert.vde.com

KEV Date Added

Kategoriler

CWE-305 Ewio2-m Firmware CRITICAL Metz-connect 2025

Referanslar

https://certvde.com/de/advisories/VDE-2025-097

Benzer Kayıtlar

High

CVE-2025-41735

A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in rem…

High

CVE-2025-41736

A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of th…

High

CVE-2025-41737

Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.

Critical

CVE-2025-41734

An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.