Metz-connect vulnerabilities
We track 2 vulnerabilities in Metz-connect products across 6 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 18, 2025.
2vulnerabilities
1critical
1high
0exploited
9.3average CVSS score
Latest Metz-connect vulnerabilities
- 8.8 High severity
Energy-Controlling EWIO2-M: Improper Limitation of a Pathname to a Restricted Directory
A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.
- 9.8 Critical severity
Energy-Controlling EWIO2-M: Authentication Bypass by Primary Weakness
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.