Advisories · Technology

METZ CONNECT Ethernet-IO EWIO2-BM.

Every CVE that names METZ CONNECT Ethernet-IO EWIO2-BM among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-41737 CVE record

CVSS 7.5 High

Improper access control via php endpoint
- METZ CONNECT Energy-Controlling EWIO2-M
- METZ CONNECT Energy-Controlling EWIO2-M-BM
- Broken access control
Not analysed yet 18 Nov 2025
CVE-2025-41736 CVE record

CVSS 8.8 High

Possible arbitrary code execution
- METZ CONNECT Energy-Controlling EWIO2-M
- METZ CONNECT Energy-Controlling EWIO2-M-BM
- Path traversal
Not analysed yet 18 Nov 2025
CVE-2025-41735 CVE record

CVSS 8.8 High

Possible arbitrary file upload
- METZ CONNECT Energy-Controlling EWIO2-M
- METZ CONNECT Energy-Controlling EWIO2-M-BM
- Unrestricted file upload
Not analysed yet 18 Nov 2025
CVE-2025-41734 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Unauthenticated Local File Inclusion in php module
- METZ CONNECT Energy-Controlling EWIO2-M
- METZ CONNECT Energy-Controlling EWIO2-M-BM
- File inclusion
Not analysed yet 18 Nov 2025
CVE-2025-41733 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Possible malfunction credential injection
- METZ CONNECT Energy-Controlling EWIO2-M
- METZ CONNECT Energy-Controlling EWIO2-M-BM
- CWE-305
Not analysed yet 18 Nov 2025