PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-41734 METZ CONNECT CVE debrief

CVE-2025-41734 is a critical unauthenticated local file inclusion issue in the php module used by METZ CONNECT EWIO2 devices. According to the CISA CSAF advisory, a remote attacker can execute arbitrary PHP files and obtain full access on affected devices. METZ CONNECT reports that SW-Version 2.2.0 or later remediates the issue, and the advisory notes that no workaround provides equivalent protection.

Vendor
METZ CONNECT
Product
Hardware
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-11-18
Original CVE updated
2025-11-18
Advisory published
2025-11-18
Advisory updated
2025-11-18

Who should care

Operators, integrators, and maintainers of METZ CONNECT EWIO2-M, EWIO2-M-BM, and EWIO2-BM devices running firmware below 2.2.0, especially in OT/ICS, building automation, or energy-monitoring environments.

Technical summary

The supplied advisory identifies an unauthenticated remote attack path against the php module and lists affected METZ CONNECT product families and firmware releases below 2.2.0. The stated impact is arbitrary PHP file execution followed by full device compromise. The advisory’s remediation is to install SW-Version 2.2.0 or later; it does not describe an equivalent workaround.

Defensive priority

Immediate. This is a network-reachable, unauthenticated vulnerability with critical CVSS 9.8 impact and a vendor fix already available.

Recommended defensive actions

  • Upgrade affected METZ CONNECT devices to SW-Version 2.2.0 or later as soon as possible.
  • Inventory EWIO2-M, EWIO2-M-BM, and EWIO2-BM deployments and verify firmware versions before and after remediation.
  • Prioritize patching for any exposed or remotely managed devices, especially those reachable from untrusted networks.
  • Use compensating controls such as network segmentation and strict access restriction to reduce exposure until patching is complete.

Evidence notes

All substantive claims are taken from the supplied CISA CSAF advisory ICSA-25-322-05 and its referenced vendor materials. The advisory explicitly states the unauthenticated remote impact, names the affected METZ CONNECT product families, and identifies SW-Version 2.2.0 or later as the fix. The supplied enrichment does not indicate a KEV entry.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-41734 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-41734

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-41734 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-41734

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-322-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://metz-connect.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-097.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/VDE-2025-097

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/de/advisories/vendor/metz-connect/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-322-05

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.