CVE-2025-41736

High CVSS: 8.8

A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.

Vendor

Metz-connect

Product

Ewio2-m Firmware

CWE

CWE-35

Yayın Tarihi

2025-11-18 11:15:47

Güncelleme

2025-11-21 19:15:07

Source Identifier

info@cert.vde.com

KEV Date Added

Kategoriler

CWE-35 Ewio2-m Firmware HIGH Metz-connect 2025

Referanslar

https://certvde.com/de/advisories/VDE-2025-097

Benzer Kayıtlar

High

CVE-2025-41735

A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in rem…

High

CVE-2025-41737

Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.

Critical

CVE-2025-41733

The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthentica…

Critical

CVE-2025-41734

An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.