PT-2025-47291 · Metz Connect · Ewio2-M

Noam Moshe + 1 · Published 2025-11-18 · Updated 2025-11-18 · CVE-2025-41734

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions METZ CONNECT EWIO2-M versions prior to 2.2.0 METZ CONNECT Ethernet-IO EWIO2-BM versions prior to 2.2.0

Description An unauthenticated remote attacker can execute arbitrary PHP files and gain full access of the affected devices. This allows malicious actors to run malicious scripts without authentication, leading to full control over the device. The vulnerability affects industrial IoT control systems.

Recommendations METZ CONNECT EWIO2-M versions prior to 2.2.0: Update to version 2.2.0 or later. METZ CONNECT Ethernet-IO EWIO2-BM versions prior to 2.2.0: Update to version 2.2.0 or later.

Fix

RCE

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-41734

Affected Products

Ewio2-M

References · 11

• https://osv.dev/vulnerability/CVE-2025-41734 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-41734 · Security Note
• https://certvde.com/de/advisories/VDE-2025-097 · Note
• https://twitter.com/offseq/status/1990729496438194506 · Twitter Post
• https://twitter.com/CveFindCom/status/1990882998388973704 · Twitter Post
• https://twitter.com/CveTodo/status/1990744801491202128 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1990764414039990692 · Twitter Post
• https://t.me/CVEtracker/37604 · Telegram Post
• https://t.me/cveNotify/143185 · Telegram Post
• https://twitter.com/CVEnew/status/1990733418405970073 · Twitter Post
• https://twitter.com/gothburz/status/1990858294945030452 · Twitter Post