CVE-2025-41734: Unauthenticated Local File Inclusion in php module
Published Nov 18, 2025
·Updated
An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.
Affected Software
6 affected components
All of the following
Metz-connect Ewio2-m Firmware<2.2.0
Metz-connect Ewio2-m
All of the following
Metz-connect Ewio2-m-bm Firmware<2.2.0
Metz-connect Ewio2-m-bm
All of the following
Metz-connect Ewio2-bm Firmware<2.2.0
Metz-connect Ewio2-bm
Event History
Nov 18, 2025
CVE Published
via MITRE·10:18 AM
Data Sourced
via MITRE·10:18 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-41734?
CVE-2025-41734 is classified as a critical vulnerability due to its potential to allow unauthenticated remote attackers to execute arbitrary PHP files.
2
How do I fix CVE-2025-41734?
To fix CVE-2025-41734, upgrade the affected Metz-connect Ewio2 firmware to version 2.2.0 or later.
3
What products are affected by CVE-2025-41734?
CVE-2025-41734 affects the Metz-connect Ewio2-m, Ewio2-m-bm, and Ewio2-bm firmware versions prior to 2.2.0.
4
Can CVE-2025-41734 be exploited remotely?
Yes, CVE-2025-41734 can be exploited remotely by unauthenticated attackers.
5
What are the risks associated with CVE-2025-41734?
The risks associated with CVE-2025-41734 include unauthorized access, data breaches, and control over affected devices.