CVE-2025-41734

Critical CVSS: 9.8

An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.

Vendor

Product

CWE

Yayın Tarihi

2025-11-18 11:15:46

Güncelleme

2025-11-21 19:14:59

Source Identifier

info@cert.vde.com

KEV Date Added

CWE-98 Ewio2-m Firmware CRITICAL Metz-connect 2025

https://certvde.com/de/advisories/VDE-2025-097

High

CVE-2025-41735

A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in rem…

High

CVE-2025-41736

A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of th…

High

CVE-2025-41737

Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.

Critical

CVE-2025-41733

The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthentica…