CVE-2025-41733
Critical
Description
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
SeverityCritical
CVSS9.8
Exploit probability—
ProductMetz-connect Ewio2-m Firmware
PublishedNov 18, 2025
First seenNov 18, 2025
Weakness typeCWE-305CWE-305
How to fix
Update
- metz-connect ewio2-m_firmware2.2.0 or later
- metz-connect ewio2-m-bm_firmware2.2.0 or later
- metz-connect ewio2-bm_firmware2.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| metz-connect ewio2-m_firmware | v < 2.2.0 | 2.2.0 |
| metz-connect ewio2-m-bm_firmware | v < 2.2.0 | 2.2.0 |
| metz-connect ewio2-bm_firmware | v < 2.2.0 | 2.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.