by Kastro
Paper/Archive/CVE-2025-41734

CVE-2025-41734

METZ CONNECT Energy-Controlling EWIO2-M — Unauthenticated Local File Inclusion in php module

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 46.8.468 × 209.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.

Affected

ProductAffectedFixed inSource
Energy-Controlling EWIO2-M0.0.0 – < 2.2.02.2.0CNA
Energy-Controlling EWIO2-M-BM0.0.0 – < 2.2.02.2.0CNA
Ethernet-IO EWIO2-BM0.0.0 – < 2.2.02.2.0CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcertvde.com/de/advisories/VDE-2025-097