External risk intelligence

METZ CONNECT EWIO2 Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-41734

The affected products are METZ CONNECT EWIO2 automation devices, which are designed as industrial gateways and controllers. These devices are frequently deployed as internet-facing or network-connected management interfaces for building and industrial automation, making their web-based administration surfaces commonly reachable in real-world deployment scenarios.

Metz Connect Ewio2 M Firmware

before 2.2.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in certain METZ CONNECT automation devices, allowing unauthenticated attackers to execute arbitrary code remotely and take full control of affected systems. This poses a significant risk due to the potential for unauthorized access and malicious operations on industrial and building automation networks. The main concern is confirming the relevance and exposure of these devices within our infrastructure.

Unauthenticated attackers can remotely control affected devices.
This could disrupt operations or compromise sensitive data.
Confirm if these devices are in use and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can reach the affected device over the network. By triggering a vulnerability in the device's web interface, the attacker can upload and execute arbitrary PHP files, leading to complete control of the device.

Network access required.
Arbitrary PHP file execution.
Full device compromise.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could execute arbitrary PHP files on affected devices, potentially leading to full system access. This could occur when the devices are accessible via a network.

Affected devices and system data.
Remote code execution over network.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in METZ CONNECT EWIO2 devices allows unauthenticated remote attackers to execute arbitrary PHP code and gain full device access. Ownership likely falls to the infrastructure or industrial control system (ICS) teams responsible for these devices. The immediate priority is to identify all deployed EWIO2 devices, assess their network exposure and business criticality, and confirm the accountable system owner before planning remediation.

Infrastructure or ICS teams should own the issue.
Verify network exposure and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the METZ CONNECT EWIO2?

The METZ CONNECT EWIO2 family consists of industrial gateways and controllers used for building and industrial automation. These devices function as essential management interfaces that bridge local sensors and actuators with broader network control systems, typically managing data flow and operational logic in facility infrastructure.

What does CWE-98 mean for CVE-2025-41734?

CWE-98 refers to Improper Control of Filename for Include/Require Statement in PHP Programs. In the context of CVE-2025-41734, this vulnerability means the device's software incorrectly handles file inclusions, allowing an unauthorized person to force the system to execute arbitrary PHP code files. This flaw effectively bypasses intended security controls and grants the attacker full control over the device's functions.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by accessing the device's web administration interface over a network. Because the system does not require authentication, the attacker can upload and execute malicious PHP files directly. This requires network connectivity to the management interface; the vulnerability is not triggered by physical interaction, local console access, or standard background operations that do not involve the web-based file handling interface.

Why does Halo Surface Signal flag this as a risk?

Halo Surface Signal identifies this as a likely risk because EWIO2 devices are frequently deployed as internet-facing or network-connected management interfaces. Given their role in building and industrial automation, these management surfaces are often reachable within common deployment scenarios, meaning an attacker may not need to be on the local physical network to initiate the attack.

What steps should I take if I use these devices?

First, locate and inventory all EWIO2 devices within your environment to confirm which versions are running. Prioritize identifying units that are reachable over the network, especially those connected to the internet. Once identified, consult the manufacturer for official firmware updates to replace vulnerable versions, and ensure these management interfaces are moved to isolated networks or protected by strict access controls.

References

certvde.com/de/advisories/VDE-2025-097

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.