CVE-2025-41733 is a critical vulnerability in the commissioning wizard of certain devices where the wizard fails to check if the device has already been initialized. This flaw allows an unauthenticated remote attacker to send crafted POST requests to set root credentials, potentially leading to full system compromise.