CVE Catalog
CVE-2025-41733
CriticalSummary
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
Risk Assessment
An attacker can gain root privileges on the device, leading to full compromise of the device.
Recommendation
It is recommended to immediately restrict access to the commissioning wizard, apply patches, and implement authentication mechanisms before initialization.
Original NVD description (English source)
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.