CVE-2025-41735

Summary

A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.

Affected Software

VendorProductVersion RangeStatus
METZ CONNECTEnergy-Controlling EWIO2-M0.0.0 < 2.2.0affected
METZ CONNECTEnergy-Controlling EWIO2-M-BM0.0.0 < 2.2.0affected
METZ CONNECTEthernet-IO EWIO2-BM0.0.0 < 2.2.0affected

Weaknesses

  • CWE-434: CWE-434 Unrestricted Upload of File with Dangerous Type

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References