Description (CNA)
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| METZ CONNECT / Energy-Controlling EWIO2-M | affected 0.0.0 before 2.2.0 |
| METZ CONNECT / Energy-Controlling EWIO2-M-BM | affected 0.0.0 before 2.2.0 |
| METZ CONNECT / Ethernet-IO EWIO2-BM | affected 0.0.0 before 2.2.0 |
CWE
CWE-305
References
ADP enrichment
No English description supplied.
No references supplied.