PT-2025-47291 · Metz Connect · Ewio2-M

Noam Moshe + 1 · Publicado 2025-11-18 · Atualizado 2025-11-18 · CVE-2025-41734

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions METZ CONNECT EWIO2-M versions prior to 2.2.0 METZ CONNECT Ethernet-IO EWIO2-BM versions prior to 2.2.0

Description An unauthenticated remote attacker can execute arbitrary PHP files and gain full access of the affected devices. This allows malicious actors to run malicious scripts without authentication, leading to full control over the device. The vulnerability affects industrial IoT control systems.

Recommendations METZ CONNECT EWIO2-M versions prior to 2.2.0: Update to version 2.2.0 or later. METZ CONNECT Ethernet-IO EWIO2-BM versions prior to 2.2.0: Update to version 2.2.0 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-98

Identificadores relacionados

CVE-2025-41734

Produtos afetados

Ewio2-M

Referências · 11

• https://certvde.com/de/advisories/VDE-2025-097 · Nota
• https://twitter.com/offseq/status/1990729496438194506 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/1990882998388973704 · Publicação no Twitter
• https://twitter.com/CveTodo/status/1990744801491202128 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-41734 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1990764414039990692 · Publicação no Twitter
• https://t.me/CVEtracker/37604 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-41734 · Nota de Segurança
• https://t.me/cveNotify/143185 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1990733418405970073 · Publicação no Twitter
• https://twitter.com/gothburz/status/1990858294945030452 · Publicação no Twitter