{"id":"CVE-2025-41733","aliases":["EUVD-2025-197985","GHSA-rg84-wv55-qxqc"],"status":"published","title":"Possible malfunction credential injection","description":"The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00648,"percentile":0.51365,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-305"],"published":"2025-11-18T10:17:46Z","modified":"2026-10-18T20:10:00Z","products":[{"vendor":"metz connect","product":"energy-controlling ewio2-m"},{"vendor":"metz connect","product":"energy-controlling ewio2-m-bm"},{"vendor":"metz connect","product":"ethernet-io ewio2-bm"},{"vendor":"metz-connect","product":"ewio2-bm_firmware"},{"vendor":"metz-connect","product":"ewio2-m-bm_firmware"},{"vendor":"metz-connect","product":"ewio2-m_firmware"}],"references":[{"url":"https://certvde.com/de/advisories/VDE-2025-097","tags":["Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-41733"},{"url":"https://github.com/advisories/GHSA-rg84-wv55-qxqc"}],"sources":{"cve":[{"id":"CVE-2025-41733","title":"Possible malfunction credential injection","description":"The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.","status":"published","published":"2025-11-18T10:17:46.326Z","modified":"2025-11-18T21:17:53.438Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:32:31.631102Z"}],"euvd":[{"id":"EUVD-2025-197985","description":"The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.","status":"published","published":"2025-11-18T10:17:46Z","modified":"2025-11-18T21:17:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:15.429944Z"}],"ghsa":[{"id":"GHSA-rg84-wv55-qxqc","title":"The commissioning wizard on the affected devices does not validate if the device is already...","description":"The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.","status":"published","published":"2025-11-18T12:30:18Z","modified":"2025-11-18T12:30:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T15:04:50.769565Z"}],"nvd":[{"id":"CVE-2025-41733","description":"The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.","status":"published","published":"2025-11-18T11:15:46.7Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:11:44.669367Z"}]}}