Description
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| METZ CONNECT | Energy-Controlling EWIO2-M | 0.0.0 – < 2.2.0 | 2.2.0 |
| METZ CONNECT | Energy-Controlling EWIO2-M-BM | 0.0.0 – < 2.2.0 | 2.2.0 |
| METZ CONNECT | Ethernet-IO EWIO2-BM | 0.0.0 – < 2.2.0 | 2.2.0 |
Advisories 2
- ICSA-25-322-05 METZ CONNECT EWIO2 CISA ICS & IT advisories · Nov 18, 2025
- VDE-2025-097 METZ CONNECT: Config API – Authentication bypass leads to admin takeover in EWIO2 series CERT@VDE · Nov 18, 2025