CVE-2025-41733

The vulnerability results from the lack of verification of the device initialization state in the commissioning wizard mechanism (CWE-305: Authentication Bypass by Primary Weakness). An attacker can send properly crafted HTTP POST requests directly to the wizard endpoint, even if the device has been previously configured. As a result, it is possible to set arbitrary credentials for the root account without any prior authentication. The attack does not require user interaction or knowledge of existing credentials.

An attacker gains full administrative control over the device by taking over the root account, leading to violations of confidentiality, integrity, and availability of the system and the data it processes.

Apply patches available from the manufacturer in accordance with the references (https://certvde.com/de/advisories/VDE-2025-097). Until the fix is implemented, it is recommended to isolate devices from public networks, restrict access to the management interface only to trusted hosts, and monitor unauthorized POST requests to the configuration wizard endpoints.

Metz-Connect Ewio2-BM, Ewio2-M-BM, and Ewio2-M devices along with their corresponding firmware versions — specific versions indicated in the manufacturer references (VDE-2025-097).