CVE-2025-41733 — Possible malfunction credential injection
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set ro…
Published: 2025-11-18 · CVSS: 9.8 · CVSS 3.1
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7