Description
A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| METZ CONNECT | Energy-Controlling EWIO2-M | 0.0.0 – < 2.2.0 | 2.2.0 |
| METZ CONNECT | Energy-Controlling EWIO2-M-BM | 0.0.0 – < 2.2.0 | 2.2.0 |
| METZ CONNECT | Ethernet-IO EWIO2-BM | 0.0.0 – < 2.2.0 | 2.2.0 |
Advisories 2
- ICSA-25-322-05 METZ CONNECT EWIO2 CISA ICS & IT advisories · Nov 18, 2025
- VDE-2025-097 METZ CONNECT: Config API – Authentication bypass leads to admin takeover in EWIO2 series CERT@VDE · Nov 18, 2025