CVE-2025-41737: Improper access control via php endpoint
Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41737?
CVE-2025-41737 is considered a high severity vulnerability due to its ability to allow unauthenticated remote attackers to read sensitive source code.
How do I fix CVE-2025-41737?
To fix CVE-2025-41737, you should review and properly configure your webserver to restrict access to PHP module source files.
What types of devices are affected by CVE-2025-41737?
CVE-2025-41737 affects Metz-connect Ewio2-m, Ewio2-m-bm, and Ewio2-bm firmware versions prior to 2.2.0.
What is the risk of exploitation for CVE-2025-41737?
The risk of exploitation for CVE-2025-41737 includes potential data leakage and exposure of sensitive information from the source code.
Who can be impacted by CVE-2025-41737?
Any user utilizing the affected Metz-connect firmware devices may be impacted by CVE-2025-41737 if their webserver is misconfigured.