Critical · published November 18, 2025
🚨 An attacker needs nothing but a crafted request to execute arbitrary PHP files on devices! This vulnerability is critical and striking at the heart of security. 🔥 Think of this vulnerability like a restaurant with a backdoor that anyone can enter without a reservation. Once inside, an attacker can change the menu, steal food, or even lock the staff out of their kitchen! With full access, an attacker could manipulate settings, steal sensitive data, or completely compromise your device. This isn't just a breach; it's an open invitation for a catastrophic takeover! Imagine them serving whatever dish they want on your network — absolutely devastating.
Think of this vulnerability like a restaurant with a backdoor that anyone can enter without a reservation. Once inside, an attacker can change the menu, steal food, or even lock the staff out of their kitchen! CVE-2025-41734 allows unauthenticated remote attackers to execute arbitrary PHP files on vulnerable devices, enabling them to gain full control and access to the system without any prior login or authentication.
With full access, an attacker could manipulate settings, steal sensitive data, or completely compromise your device. This isn't just a breach; it's an open invitation for a catastrophic takeover! Imagine them serving whatever dish they want on your network — absolutely devastating. Patch your systems immediately to the latest secure version to close this loophole. It’s crucial to review permissions and ensure that only authenticated requests can trigger PHP execution. Double-check your configurations to prevent unauthorized access. You've got this! Take action now and secure your devices like a pro! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| metz-connect/ewio2-m_firmware | < 2.2.0 | 2.2.0 |
| metz-connect/ewio2-m-bm_firmware | < 2.2.0 | 2.2.0 |
| metz-connect/ewio2-bm_firmware | < 2.2.0 | 2.2.0 |