Ewio2-bm Firmware vulnerabilities

2 known vulnerabilities in Ewio2-bm Firmware from Metz-connect. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Energy-Controlling EWIO2-M: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-41736Nov 18, 2025Metz-connect

  A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.

• 9.8 Critical severity

  Energy-Controlling EWIO2-M: Authentication Bypass by Primary Weakness

  CVE-2025-41733Nov 18, 2025Metz-connect

  The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.