CVE-2025-41735

High CVSS: 8.8

A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.

Vendor

Product

CWE

Yayın Tarihi

2025-11-18 11:15:47

Güncelleme

2025-11-21 19:15:17

Source Identifier

info@cert.vde.com

KEV Date Added

CWE-434 Ewio2-m Firmware HIGH Metz-connect 2025

https://certvde.com/de/advisories/VDE-2025-097

High

CVE-2025-41736

A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of th…

High

CVE-2025-41737

Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.

Critical

CVE-2025-41733

The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthentica…

Critical

CVE-2025-41734

An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.