CVE-2025-41733

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-305

Affected software

VendorProductVersions
METZ CONNECTEnergy-Controlling EWIO2-M>= 0.0.0, < 2.2.0
METZ CONNECTEnergy-Controlling EWIO2-M-BM>= 0.0.0, < 2.2.0
METZ CONNECTEthernet-IO EWIO2-BM>= 0.0.0, < 2.2.0

References

Timeline

Published
Nov 18, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-417349.8An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.CVE-2025-417358.8A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.CVE-2025-417368.8A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename inCVE-2025-417377.5Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.CVE-2025-417387.5An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a poinCVE-2025-417395.9An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtiCVE-2025-41749.8A vulnerability, which was classified as critical, has been found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this issuCVE-2025-417429.8Sprecher Automations SPRECON-E-C,  SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptogrCVE-2025-417434.0Insufficient encryption strength in Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 allows a local unprivileged attacker to eCVE-2025-417449.1Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted comCVE-2025-417457.1An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulCVE-2025-417467.1An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipu
CVE-2025-41733: Critical severity, CVSS 9.8 | Vulnix