CVE-2025-41736 HIGH

CVE-2025-41736: Possible arbitrary code execution

Vendor Metz Connect
Product Energy-Controlling EWIO2-M
Weakness CWE-35
Published November 18, 2025
Last update November 18, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.

Key dates

02Disclosure timeline

November 18, 2025 CVE published
November 18, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-49112 WordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerability CVE-2024-56055 WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary Directory Deletion vulnerability CVE-2023-39916 Possible path traversal when storing RRDP responses CVE-2025-42937 Directory Traversal vulnerability in SAP Print Service CVE-2024-5481 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function