CVE-2025-41734

Katalog CVE

CVSS 9.8 · Critical EPSS 0,52%

Kerentanan Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') pada metz-connect ewio2-m firmware, metz-connect ewio2-m-bm firmware +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut cert.vde.com.

Deskripsi (NVD)

An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.

Rincian

Terbit di NVD

18 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber cert.vde.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://certvde.com/de/advisories/VDE-2025-097 advisory pihak ketiga