# CVE-2025-41737: Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.

Source: https://junglewise.ai/threats/cve-2025-41737-due-to-webserver-misconfiguration-an-unauthenticated-remote  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-18  
License: CC BY 4.0 with a link back

CVE-2025-41737 · Severity: high · CVSS 7.5 · Published 2025-11-18

Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.

Technologies: [Metz-Connect Ewio2-Bm](https://junglewise.ai/threats/technologies/ewio2-bm), [Metz-Connect Ewio2-Bm Firmware](https://junglewise.ai/threats/technologies/ewio2-bm-firmware), [Metz-Connect Ewio2-M](https://junglewise.ai/threats/technologies/ewio2-m), [Metz-Connect Ewio2-M Firmware](https://junglewise.ai/threats/technologies/ewio2-m-firmware), [Metz-Connect Ewio2-M-Bm](https://junglewise.ai/threats/technologies/ewio2-m-bm), [Metz-Connect Ewio2-M-Bm Firmware](https://junglewise.ai/threats/technologies/ewio2-m-bm-firmware). Vendors: [Metz-Connect](https://junglewise.ai/threats/vendors/metz-connect).

## Quick answers

**Is CVE-2025-41737 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-41737 being exploited in the wild.

**How severe is CVE-2025-41737?** High severity, with a CVSS score of 7.5, published 18 November 2025.

**Which products and versions are affected?** Metz-Connect Ewio2-Bm, Metz-Connect Ewio2-Bm Firmware, Metz-Connect Ewio2-M, Metz-Connect Ewio2-M Firmware and 2 more. The advisory does not name versions.

**Is there a fix for CVE-2025-41737?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-41737?** Check whether you run Metz-Connect Ewio2-Bm, Metz-Connect Ewio2-Bm Firmware, Metz-Connect Ewio2-M or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Metz-Connect Ewio2-Bm
- Metz-Connect Ewio2-Bm Firmware
- Metz-Connect Ewio2-M
- Metz-Connect Ewio2-M Firmware
- Metz-Connect Ewio2-M-Bm
- Metz-Connect Ewio2-M-Bm Firmware

## Related threats

- [A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of…](https://junglewise.ai/threats/cve-2025-41736-a-low-privileged-remote-attacker-can-upload-a-new-or-overwrite-an)
- [A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.](https://junglewise.ai/threats/cve-2025-41735-a-low-privileged-remote-attacker-can-upload-any-file-to-an)
- [An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.](https://junglewise.ai/threats/cve-2025-41734-an-unauthenticated-remote-attacker-can-execute-arbitrary-php)
- [The commissioning wizard on the affected devices does not validate if the device is already initialized. An…](https://junglewise.ai/threats/cve-2025-41733-the-commissioning-wizard-on-the-affected-devices-does-not)