CVE-2025-41734

Summary

An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.

Affected Software

VendorProductVersion RangeStatus
METZ CONNECTEnergy-Controlling EWIO2-M0.0.0 < 2.2.0affected
METZ CONNECTEnergy-Controlling EWIO2-M-BM0.0.0 < 2.2.0affected
METZ CONNECTEthernet-IO EWIO2-BM0.0.0 < 2.2.0affected

Weaknesses

  • CWE-98: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References