CVE-2025-41735: Metz-connect Ewio2-m Firmware RCE Flaw

CVE-2025-41735 Overview

CVE-2025-41735 is an unrestricted file upload vulnerability [CWE-434] affecting Metz Connect EWIO2 energy measurement devices. A low-privileged remote attacker can upload arbitrary files to any location on the device because the application fails to validate uploaded content. This missing file check allows attackers to place executable content in sensitive paths, resulting in remote code execution. The flaw impacts the EWIO2-M, EWIO2-M-BM, and EWIO2-BM product lines along with their associated firmware. Exploitation requires only low-level credentials and network access to the device's management interface.

Critical Impact
Authenticated attackers can achieve remote code execution on industrial energy measurement devices, compromising confidentiality, integrity, and availability of operational technology environments.

Affected Products

Metz Connect EWIO2-M and EWIO2-M firmware
Metz Connect EWIO2-M-BM and EWIO2-M-BM firmware
Metz Connect EWIO2-BM and EWIO2-BM firmware

Discovery Timeline

2025-11-18 - CVE-2025-41735 published to NVD
2025-11-21 - Last updated in NVD database

Technical Details for CVE-2025-41735

Vulnerability Analysis

The vulnerability resides in the file upload functionality exposed by the EWIO2 device web interface. The application accepts file uploads from authenticated users without enforcing validation on file type, extension, content, or destination path. An attacker holding low-privilege credentials can submit a crafted upload request that writes attacker-controlled content to an arbitrary location on the device filesystem.

Because the EWIO2 platform executes scripts and binaries from predictable system paths, writing to those locations enables code execution under the privileges of the receiving process. The Common Weakness Enumeration classification [CWE-434] covers unrestricted upload of files with dangerous types, which directly matches the observed behavior described in the CERT VDE advisory.

Root Cause

The root cause is the absence of server-side validation on the upload handler. The application does not enforce allow-lists for file extensions, does not verify MIME types, and does not constrain the destination directory. This combination permits both arbitrary file placement and execution of attacker-supplied payloads.

Attack Vector

The attack is network-reachable and requires authenticated access at a low privilege level. An attacker who obtains or is granted minimal user credentials sends a crafted HTTP request to the upload endpoint, supplying a target path that resolves outside the intended upload directory. The supplied payload is written to the chosen path and executed by the device when triggered through scheduled jobs, web routes, or system processes that consume files from that location.

No public proof-of-concept exploit is currently available. See the CERT VDE Advisory VDE-2025-097 for vendor-confirmed technical details.

Detection Methods for CVE-2025-41735

Indicators of Compromise

Unexpected files appearing in system directories or web-accessible paths on EWIO2 devices
Authenticated HTTP upload requests containing path traversal sequences or absolute destination paths
Outbound network connections originating from EWIO2 devices to unfamiliar destinations
New or modified scripts in directories that are executed by device services

Detection Strategies

Monitor the device management interface for upload requests submitted by low-privilege accounts
Inspect HTTP request bodies for filenames containing executable extensions or directory traversal patterns
Baseline the filesystem of EWIO2 devices and alert on writes outside expected upload directories
Correlate authentication events with file upload activity to identify abuse of valid credentials

Monitoring Recommendations

Forward EWIO2 device logs to a centralized logging platform for retention and analysis
Alert on process spawns from device web service contexts that execute uploaded content
Track configuration changes and firmware integrity using cryptographic hashes
Review user account inventories and remove unused low-privilege accounts that could be leveraged for authenticated exploitation

How to Mitigate CVE-2025-41735

Immediate Actions Required

Restrict network access to EWIO2 management interfaces to trusted administrative networks only
Rotate credentials for all accounts on affected devices, including low-privilege users
Audit accounts and remove any unused or default credentials
Apply the vendor-supplied firmware update referenced in the CERT VDE advisory as soon as it is available for your model

Patch Information

Metz Connect coordinates remediation through CERT@VDE. Refer to the CERT VDE Advisory VDE-2025-097 for the fixed firmware versions corresponding to EWIO2-M, EWIO2-M-BM, and EWIO2-BM hardware variants. Apply the patched firmware to all affected devices and verify version strings after the update.

Workarounds

Place affected devices behind a network firewall and block inbound access from untrusted segments
Use a VPN or jump host for all administrative access to the EWIO2 web interface
Disable or restrict accounts that are not required for production operation
Monitor device filesystems and logs continuously until firmware updates are applied

bash

# Example firewall rule to restrict EWIO2 management access
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP