Possible malfunction credential injection
Priority MEDIUM 44CWE-305Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00648 51st percentileScored 2026-11-07
Fix Fixed Energy-Controlling EWIO2-M (METZ CONNECT): 2.2.0Energy-Controlling EWIO2-M-BM (METZ CONNECT): 2.2.0+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| METZ CONNECT | Energy-Controlling EWIO2-M | 0.0.0 to before 2.2.0 | 2.2.0 | Patch available | CNA |
| METZ CONNECT | Energy-Controlling EWIO2-M-BM | 0.0.0 to before 2.2.0 | 2.2.0 | Patch available | CNA |
| METZ CONNECT | Ethernet-IO EWIO2-BM | 0.0.0 to before 2.2.0 | 2.2.0 | Patch available | CNA |
- Energy-Controlling EWIO2-M VendorMETZ CONNECT Affected 0.0.0 to before 2.2.0 Fixed in 2.2.0 Patch available CNA
- Energy-Controlling EWIO2-M-BM VendorMETZ CONNECT Affected 0.0.0 to before 2.2.0 Fixed in 2.2.0 Patch available CNA
- Ethernet-IO EWIO2-BM VendorMETZ CONNECT Affected 0.0.0 to before 2.2.0 Fixed in 2.2.0 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:metz-connect:ewio2-m_firmware:*:*:*:*:*:*:*:* | before 2.2.0 | Vulnerable | METZ CONNECT |
| cpe:2.3:h:metz-connect:ewio2-m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | METZ CONNECT |
| cpe:2.3:o:metz-connect:ewio2-m-bm_firmware:*:*:*:*:*:*:*:* | before 2.2.0 | Vulnerable | METZ CONNECT |
| cpe:2.3:h:metz-connect:ewio2-m-bm:-:*:*:*:*:*:*:* | not specified by NVD | Running on | METZ CONNECT |
| cpe:2.3:o:metz-connect:ewio2-bm_firmware:*:*:*:*:*:*:*:* | before 2.2.0 | Vulnerable | METZ CONNECT |
| cpe:2.3:h:metz-connect:ewio2-bm:-:*:*:*:*:*:*:* | not specified by NVD | Running on | METZ CONNECT |
- cpe:2.3:o:metz-connect:ewio2-m_firmware:*:*:*:*:*:*:*:* Versions before 2.2.0 Vulnerable ·METZ CONNECT
- cpe:2.3:h:metz-connect:ewio2-m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·METZ CONNECT
- cpe:2.3:o:metz-connect:ewio2-m-bm_firmware:*:*:*:*:*:*:*:* Versions before 2.2.0 Vulnerable ·METZ CONNECT
- cpe:2.3:h:metz-connect:ewio2-m-bm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·METZ CONNECT
- cpe:2.3:o:metz-connect:ewio2-bm_firmware:*:*:*:*:*:*:*:* Versions before 2.2.0 Vulnerable ·METZ CONNECT
- cpe:2.3:h:metz-connect:ewio2-bm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·METZ CONNECT
Remediation
- Fix · CNA Energy-Controlling EWIO2-M (METZ CONNECT) Fixed in 2.2.0
- Fix · CNA Energy-Controlling EWIO2-M-BM (METZ CONNECT) Fixed in 2.2.0
- Fix · CNA Ethernet-IO EWIO2-BM (METZ CONNECT) Fixed in 2.2.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
METZ CONNECT Energy-Controlling EWIO2-M, Energy-Controlling EWIO2-M-BM, Ethernet-IO EWIO2-BM 2.2.0
5 records Highest priority Priority MEDIUM 4 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-27696 Unauthenticated Local File Inclusion in php modulePriority MEDIUM 50
- TI-2025-27698 Possible arbitrary code executionPriority MEDIUM 41
- TI-2025-27697 Possible arbitrary file uploadPriority MEDIUM 41
Timeline
- 2026-10-02 Threatist record created from CVE-2025-41733
- 2026-10-03 Alias added: GHSA-rg84-wv55-qxqc
- 2026-10-19 EPSS moved to the 50th–90th percentile
References
More METZ CONNECT Ewio2-bm Firmware vulnerabilities
- TI-2025-27696 Unauthenticated Local File Inclusion in php module CVSS 3.1CRITICAL 9.8
- TI-2025-27698 Possible arbitrary code execution CVSS 3.1HIGH 8.8
- TI-2025-27697 Possible arbitrary file upload CVSS 3.1HIGH 8.8
- TI-2025-27699 Improper access control via php endpoint CVSS 3.1HIGH 7.5
Sources
- CVE-2025-41733 · CVE Program
- CVE-2025-41733 · NVD
- FIRST EPSS
- GHSA-rg84-wv55-qxqc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences