CVE-2025-41736 - Vulnerability Details - OpenCVE

A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Metz Connect	Ewio2

No data.

No data.

References

Link	Providers
https://certvde.com/de/advisories/VDE-2025-097

History

Wed, 19 Nov 2025 11:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Metz Connect Metz Connect ewio2
Vendors & Products		Metz Connect Metz Connect ewio2

Tue, 18 Nov 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 18 Nov 2025 10:30:00 +0000

Type	Values Removed	Values Added
Description		A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.
Title		Possible arbitrary code execution
Weaknesses		CWE-35
References		https://certvde.com/de/advisories/VDE-2025-097
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2025-11-18T10:18:30.034Z

Updated: 2025-11-18T20:54:27.218Z

Reserved: 2025-04-16T11:17:48.320Z

Link: CVE-2025-41736

Vulnrichment

Updated: 2025-11-18T20:51:12.857Z

NVD

Status : Awaiting Analysis

Published: 2025-11-18T11:15:47.400

Modified: 2025-11-18T14:06:29.817

Link: CVE-2025-41736

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-41736", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2025-04-16T11:17:48.320Z", "datePublished": "2025-11-18T10:18:30.034Z", "dateUpdated": "2025-11-18T20:54:27.218Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Energy-Controlling EWIO2-M", "vendor": "METZ CONNECT", "versions": [{"lessThan": "2.2.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Energy-Controlling EWIO2-M-BM", "vendor": "METZ CONNECT", "versions": [{"lessThan": "2.2.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Ethernet-IO EWIO2-BM", "vendor": "METZ CONNECT", "versions": [{"lessThan": "2.2.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Noam Moshe from Claroty Team82"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Tomer Goldschmidt from Claroty Team82"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.<br>"}], "value": "A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-35", "description": "CWE-35 Path Traversal: '.../...//'", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-11-18T10:18:30.034Z"}, "references": [{"url": "https://certvde.com/de/advisories/VDE-2025-097"}], "source": {"advisory": "VDE-2025-097", "defect": ["CERT@VDE#641881"], "discovery": "UNKNOWN"}, "title": "Possible arbitrary code execution", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T20:51:07.812932Z", "id": "CVE-2025-41736", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T20:54:27.218Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41736", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-18T20:51:07.812932Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T20:51:12.857Z"}}], "cna": {"title": "Possible arbitrary code execution", "source": {"defect": ["CERT@VDE#641881"], "advisory": "VDE-2025-097", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Noam Moshe from Claroty Team82"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Tomer Goldschmidt from Claroty Team82"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "METZ CONNECT", "product": "Energy-Controlling EWIO2-M", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "METZ CONNECT", "product": "Energy-Controlling EWIO2-M-BM", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "METZ CONNECT", "product": "Ethernet-IO EWIO2-BM", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://certvde.com/de/advisories/VDE-2025-097"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.", "supportingMedia": [{"type": "text/html", "value": "A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-35", "description": "CWE-35 Path Traversal: '.../...//'"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-11-18T10:18:30.034Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41736", "state": "PUBLISHED", "dateUpdated": "2025-11-18T20:54:27.218Z", "dateReserved": "2025-04-16T11:17:48.320Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2025-11-18T10:18:30.034Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.2"}