PatchTheCVECVE-2025-41734: An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected device
CVE-2025-41734 is a critical-severity flaw (CVSS 9.8) affecting ewio2-m firmware, ewio2-m-bm firmware, ewio2-bm firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 53%) |
| CISA exploited list | No |
| Weakness | CWE-98 |
| Published | 2025-11-18 |
| Last modified | 2026-10-18 |
Last updated 2026-10-18 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-41734?
ewio2-m firmware: upgrade to 2.2.0; ewio2-m-bm firmware: upgrade to 2.2.0; ewio2-bm firmware: upgrade to 2.2.0. Exact commands for each OS are on this page.
Is CVE-2025-41734 being exploited?
CVE-2025-41734 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-41734 affect?
CVE-2025-41734 affects ewio2-m firmware, ewio2-m-bm firmware, ewio2-bm firmware. Severity is critical (CVSS 9.8). An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.
How urgent is CVE-2025-41734?
Priority 51/100. Critical severity; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2025-41733 CRITICAL 9.8 UPGRADE UPGRADE The commissioning wizard on the affected devices does not validate if the device is already initialized
- CVE-2025-41736 HIGH 8.8 UPGRADE UPGRADE A low privileged remote attacker can upload a new or overwrite an existing python script by using a path trave
- CVE-2025-41735 HIGH 8.8 UPGRADE UPGRADE A low privileged remote attacker can upload any file to an arbitrary location due to missing file check result
- CVE-2025-41737 HIGH 7.5 UPGRADE UPGRADE Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules