CVE-2025-41733 Possible malfunction credential injection
Unauthenticated attackers can set root credentials via the commissioning wizard on uninitialized devices, leading to full device takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-41733?
CVE-2025-41733 is a critical authentication bypass vulnerability in METZ CONNECT Energy-Controlling EWIO2-M, published on 18 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
Weakness: CWE-305
Which versions are affected by CVE-2025-41733?
It affects 3 products.
Products include Metz-Connect Ewio2-Bm Firmware, Metz-Connect Ewio2-M-Bm Firmware, Metz-Connect Ewio2-M Firmware.
How do I fix CVE-2025-41733?
No fix has been published for CVE-2025-41733 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-41733 being exploited?
There is no known exploitation of CVE-2025-41733 in the wild and no public exploit code.
Other vulnerabilities in METZ CONNECT Energy-Controlling EWIO2-M
Sources
Also known as GHSA-rg84-wv55-qxqc.