by Kastro
Paper/Archive/CVE-2025-41733

CVE-2025-41733

METZ CONNECT Energy-Controlling EWIO2-M — Possible malfunction credential injection

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.1.511 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.

Affected

ProductAffectedFixed inSource
Energy-Controlling EWIO2-M0.0.0 – < 2.2.02.2.0CNA
Energy-Controlling EWIO2-M-BM0.0.0 – < 2.2.02.2.0CNA
Ethernet-IO EWIO2-BM0.0.0 – < 2.2.02.2.0CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcertvde.com/de/advisories/VDE-2025-097