TI-2025-27696 CVE-2025-41734 · GHSA-w68v-cc7m-4xg9
Unauthenticated Local File Inclusion in php module
Priority MEDIUM 50
An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.
METZ CONNECT
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
METZ CONNECT records in CISA KEVNo METZ CONNECT vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records
TI-2025-27695 CVE-2025-41733 · GHSA-rg84-wv55-qxqc
Possible malfunction credential injection
Priority MEDIUM 44
The commissioning wizard on the affected devices does not validate if the device is already initialized.
TI-2025-27698 CVE-2025-41736 · GHSA-gqmc-vx75-xcqg
Possible arbitrary code execution
Priority MEDIUM 41
A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.
TI-2025-27697 CVE-2025-41735 · GHSA-8vvf-2g79-4gqm
Possible arbitrary file upload
Priority MEDIUM 41
A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.
TI-2025-27699 CVE-2025-41737 · GHSA-hwv7-hhjx-9j44
Improper access control via php endpoint
Priority LOW 39
Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.