CVE-2025-41734

A vulnerability classified as CWE-98 (PHP Remote File Inclusion) allows an attacker to force execution of arbitrary PHP files through a vulnerable component of the device's web application. The attack is possible remotely over the network and does not require any privileges or user interaction. The correct path to a PHP file can be substituted or pointed out by the attacker in a way accepted by the application without verification of the requester's identity.

Attacker gains full access to the compromised device, which means the ability to read and modify configuration, take control of the device's industrial functions, and potentially use it as an entry point to the OT/IT network.

Patches available from the manufacturer should be applied according to references (https://certvde.com/de/advisories/VDE-2025-097). Until the fix is implemented, it is recommended to restrict network access to the web interface of devices only to trusted hosts and to isolate devices from the public internet.

Metz-Connect EWIO2-BM (firmware), Metz-Connect EWIO2-M-BM, Metz-Connect EWIO2-M (firmware) — versions indicated in manufacturer references