PatchTheCVECVE-2025-41733: The commissioning wizard on the affected devices does not validate if the device is already initialized
CVE-2025-41733 is a critical-severity flaw (CVSS 9.8) affecting ewio2-m firmware, ewio2-m-bm firmware, ewio2-bm firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 49%) |
| CISA exploited list | No |
| Weakness | CWE-305 |
| Published | 2025-11-18 |
| Last modified | 2026-10-18 |
Last updated 2026-10-18 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-41733?
ewio2-m firmware: upgrade to 2.2.0; ewio2-m-bm firmware: upgrade to 2.2.0; ewio2-bm firmware: upgrade to 2.2.0. Exact commands for each OS are on this page.
Is CVE-2025-41733 being exploited?
CVE-2025-41733 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-41733 affect?
CVE-2025-41733 affects ewio2-m firmware, ewio2-m-bm firmware, ewio2-bm firmware. Severity is critical (CVSS 9.8). The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
How urgent is CVE-2025-41733?
Priority 52/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-41734 CRITICAL 9.8 UPGRADE UPGRADE An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected device
- CVE-2025-41736 HIGH 8.8 UPGRADE UPGRADE A low privileged remote attacker can upload a new or overwrite an existing python script by using a path trave
- CVE-2025-41735 HIGH 8.8 UPGRADE UPGRADE A low privileged remote attacker can upload any file to an arbitrary location due to missing file check result
- CVE-2025-41737 HIGH 7.5 UPGRADE UPGRADE Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules