High severity8.8NVD Advisory· Published Nov 18, 2025· Updated Jun 17, 2026

CVE-2025-41736

Description

A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Connect Inc./Energy Controlling Ewio2 Mv5
Range: 0.0.0
Connect Inc./Energy Controlling Ewio2 M Bmv5
Range: 0.0.0
Connect Inc./Ethernet Io Ewio2 Bmv5
Range: 0.0.0
Connect Inc./Ewio2 M Firmware
cpe:2.3:o:metz-connect:ewio2-m_firmware:*:*:*:*:*:*:*:*
Range: <2.2.0
Connect Inc./Ewio2 M Bm Firmware
cpe:2.3:o:metz-connect:ewio2-m-bm_firmware:*:*:*:*:*:*:*:*
Range: <2.2.0
Connect Inc./Ewio2 Bm Firmware
cpe:2.3:o:metz-connect:ewio2-bm_firmware:*:*:*:*:*:*:*:*
Range: <2.2.0

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

CVE-2025-41736

Description

AI Insight

Affected products

Patches

Vulnerability mechanics

References

News mentions