BaseFortify

Publication date: 2025-11-18

Last updated on: 2025-11-21

Assigner: CERT VDE

Description

Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-18

Last Modified

2025-11-21

Generated

2026-07-06

AI Q&A

2025-11-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-41737

EUVD

EUVD-2025-197981

Affected Vendors & Products

Vendor	Product	Version / Range
metz-connect	ewio2-m_firmware	to 2.2.0 (exc)
metz-connect	ewio2-m	*
metz-connect	ewio2-m-bm_firmware	to 2.2.0 (exc)
metz-connect	ewio2-m-bm	*
metz-connect	ewio2-bm_firmware	to 2.2.0 (exc)
metz-connect	ewio2-bm	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-NVD-CWE-noinfo

Attack-Flow Graph

Executive Summary

This vulnerability occurs due to a webserver misconfiguration that allows an unauthenticated remote attacker to read the source code of PHP modules.

Impact Analysis

An attacker can read the source code of PHP modules, potentially exposing sensitive information such as credentials, business logic, or other confidential data, which can lead to further attacks or data breaches.

Hi! I’m here to help you understand CVE-2025-41737. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70