CVE-2025-41736 Overview
CVE-2025-41736 is a path traversal vulnerability in Metz Connect EWIO2 firmware that enables authenticated remote code execution. A low-privileged attacker can upload a new Python script or overwrite an existing one by manipulating the target filename in a PHP upload handler. The traversal allows files to be written outside the intended directory, where they are subsequently executed by the device. The vulnerability affects multiple EWIO2 hardware variants used in industrial energy monitoring environments.
Critical Impact
Authenticated attackers with low privileges can achieve full remote code execution on affected EWIO2 devices, compromising confidentiality, integrity, and availability of the industrial control system.
Affected Products
- Metz Connect EWIO2-M and EWIO2-M firmware
- Metz Connect EWIO2-M-BM and EWIO2-M-BM firmware
- Metz Connect EWIO2-BM and EWIO2-BM firmware
Discovery Timeline
- 2025-11-18 - CVE-2025-41736 published to NVD
- 2025-11-21 - Last updated in NVD database
Technical Details for CVE-2025-41736
Vulnerability Analysis
The vulnerability is a path traversal flaw [CWE-22] combined with improper handling of file paths after performing a check [CWE-35] in the device's PHP-based web interface. The flaw allows an authenticated attacker to upload Python scripts to arbitrary filesystem locations on the EWIO2 device. By placing scripts in directories where they will be loaded or executed by the firmware, the attacker triggers remote code execution under the privileges of the executing process.
The attack requires only low privileges, no user interaction, and is exploitable over the network. Successful exploitation grants full control over the device, including the ability to manipulate energy monitoring data, pivot into adjacent operational technology (OT) segments, or disrupt building automation functions.
Root Cause
The PHP upload handler accepts a user-controlled filename parameter without sufficient canonicalization. Sequences such as ../ in the target filename allow the attacker to escape the intended upload directory. Because the firmware later interprets uploaded Python scripts, writing to an executable path results in arbitrary code execution.
Attack Vector
An attacker authenticates to the EWIO2 web interface using any low-privileged account. The attacker then issues a script upload request through the PHP endpoint, embedding directory traversal sequences in the filename field. The malicious Python payload is written to a location where the firmware loads or executes scripts, and code execution follows on the next invocation.
No verified public proof-of-concept code is available. Refer to the CERT VDE Advisory VDE-2025-097 for vendor-confirmed technical details.
Detection Methods for CVE-2025-41736
Indicators of Compromise
- Unexpected .py files appearing in firmware directories outside the documented script upload path
- Web server access logs containing ../ or URL-encoded %2e%2e%2f sequences in upload request parameters
- Outbound network connections from EWIO2 devices to unfamiliar external hosts
- Modifications to existing Python scripts on the device with timestamps that do not match approved change windows
Detection Strategies
- Inspect PHP upload endpoint requests for traversal patterns in filename fields and reject or alert on matches
- Baseline the filesystem contents of EWIO2 devices and alert on additions or modifications to script directories
- Correlate authentication events with subsequent file upload activity to identify anomalous low-privileged users issuing script uploads
Monitoring Recommendations
- Forward EWIO2 web server logs to a centralized logging platform for traversal pattern analysis
- Monitor north-south and east-west traffic to and from EWIO2 devices for unexpected protocols or destinations
- Track configuration and firmware integrity using OT-aware monitoring tools that fingerprint file changes
How to Mitigate CVE-2025-41736
Immediate Actions Required
- Apply the firmware update referenced in CERT VDE Advisory VDE-2025-097 as soon as it is available for your device variant
- Restrict network access to the EWIO2 web interface so only authorized management hosts can reach it
- Audit all local accounts on EWIO2 devices and remove or rotate credentials for accounts that are no longer required
- Review device filesystems for unauthorized Python scripts and remove any that cannot be attributed to authorized changes
Patch Information
Metz Connect has coordinated disclosure through CERT@VDE. Consult the CERT VDE Advisory VDE-2025-097 for the list of fixed firmware versions and update procedures for each EWIO2 model.
Workarounds
- Place EWIO2 devices behind a firewall and permit management access only from a dedicated jump host
- Disable or block the script upload functionality at the network layer if it is not required for operations
- Enforce strong, unique passwords for all device accounts to raise the cost of obtaining the low-privileged access required for exploitation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
