Description
A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| METZ CONNECT | Energy-Controlling EWIO2-M | 0.0.0 – < 2.2.0 | 2.2.0 |
| METZ CONNECT | Energy-Controlling EWIO2-M-BM | 0.0.0 – < 2.2.0 | 2.2.0 |
| METZ CONNECT | Ethernet-IO EWIO2-BM | 0.0.0 – < 2.2.0 | 2.2.0 |
Advisories 2
- ICSA-25-322-05 METZ CONNECT EWIO2 CISA ICS & IT advisories · Nov 18, 2025
- VDE-2025-097 METZ CONNECT: Config API – Authentication bypass leads to admin takeover in EWIO2 series CERT@VDE · Nov 18, 2025