Critical METZ CONNECT Flaws (CVSS 9.8) Allow Unauthenticated RCE and Admin Takeover on Industrial Controllers

METZ CONNECT GmbH, in coordination with CERT@VDE, has issued an urgent advisory warning of multiple critical vulnerabilities affecting its EWIO-2 series, including Energy-Controlling EWIO2-M, EWIO2-M-BM, and Ethernet-IO EWIO2-BM devices, with some flaws ranking CVSS 9.8 and permitting unauthenticated RCE and full administrative takeover.

According to CERT@VDE advisory, “A critical authentication bypass in EWIO-2 allows unauthenticated attackers with network access to gain administrative control over the device.” The vulnerabilities span five CVEs: CVE-2025-41734 (Unauthenticated RCE via arbitrary PHP execution), CVE-2025-41733 (Commissioning Wizard allows reset of root credentials), CVE-2025-41736 (Path

traversal enabling Python script overwrite and RCE), CVE-2025-41735 (Arbitrary file upload to any location), and CVE-2025-41737 (PHP source code disclosure). Affected products run firmware earlier than 2.2.0. METZ CONNECT has released patched firmware version 2.2.0, and organisations should schedule updates, particularly for devices exposed to networks.