Loading story…
A set of critical vulnerabilities has been identified in the METZ CONNECT EWIO2 series, including models EWIO2-M, EWIO2-M-BM, and EWIO2-BM running firmware versions below 2.2.0. The most severe issue is an authentication bypass (CVE-2025-41733/41734) that allows unauthenticated attackers with network access to gain administrative control over the device. Exploitation enables attackers to change configurations, manipulate data, disrupt services, and potentially render the device inoperable. Additional vulnerabilities include improper control of filename for include/require statements, unrestricted upload of dangerous file types, path traversal, and improper access control, collectively enabling remote code execution and full device compromise.
CISA has issued an ICS advisory (ICSA-25-322-05) highlighting the remote exploitability and low attack complexity of these flaws, assigning a CVSS v4 base score of 9.3. The vulnerabilities stem from the commissioning wizard failing to validate device initialization, allowing attackers to set root credentials via crafted POST requests. Organizations using affected METZ CONNECT EWIO2 devices are urged to review technical details and apply mitigations to prevent unauthorized access and maintain device integrity and availability.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
SecurityOnline reported that critical METZ CONNECT EWIO2 vulnerabilities, rated up to CVSS 9.8, could enable unauthenticated remote code execution and administrative takeover on industrial controllers.
CISA released ICS advisory ICSA-25-322-05 as part of a batch of six industrial control systems advisories, alerting organizations to vulnerabilities affecting METZ CONNECT EWIO2 products.
CERT VDE published advisory VDE-2025-097 for METZ CONNECT EWIO2 series, describing a Config API authentication bypass that could allow an attacker to gain administrative control of affected devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecertvde.com
Open sourcecisa.gov
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA published ICS advisories warning of **critical “missing authentication for critical function”** weaknesses (CWE-306) that expose device management/control interfaces to unauthenticated access. **Synectix LAN 232 TRIO** (3-port serial-to-Ethernet adapter) is affected in **all versions** under **CVE-2026-1633** with **CVSS 3.1 10.0**, enabling unauthenticated attackers to **modify critical device settings** or **factory reset** the device. **Avation Light Engine Pro** is also affected in **all versions** under **CVE-2026-1341** with **CVSS 3.1 9.8**, allowing an attacker to **take full control** of the device due to an exposed configuration/control interface without authentication. Separate reporting highlighted a similar CISA alert for **KiloView Encoder Series** devices, tracked as **CVE-2026-1453** with **CVSS 9.8**, where missing authentication allows unauthenticated users to perform administrative actions such as **creating or deleting administrator accounts**, potentially granting full administrative control and enabling disruption or hijacking of broadcast/streaming workflows. The KiloView issue was described as affecting multiple Encoder Series models and specific firmware/hardware combinations (e.g., E1/E1-s/E2 with listed firmware versions), reinforcing the broader risk of internet- or enterprise-exposed device management planes lacking access control.
Jun 29, 2026
A critical authentication bypass vulnerability, tracked as CVE-2025-40771 with a CVSS score of 9.8, has been discovered in Siemens SIMATIC CP and SIPLUS ET 200SP industrial communication modules. The flaw affects multiple device models, including SIMATIC CP 1542SP-1, CP 1542SP-1 IRC, CP 1543SP-1, as well as SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, CP 1543SP-1 ISEC, and CP 1543SP-1 ISEC TX RAIL, specifically all versions prior to V2.4.24. The vulnerability arises from improper authentication of configuration connections, which allows unauthenticated remote attackers to gain access to sensitive configuration data on affected devices. This issue is particularly severe because it does not require any prior authentication, enabling attackers to exploit the flaw remotely without credentials. The vulnerability could be leveraged to compromise the integrity and confidentiality of industrial control systems that rely on these modules for network communication. Siemens has acknowledged the vulnerability and has released advisories to inform customers of the affected product versions. The flaw was reported by Siemens ProductCERT, and the company has urged users to update to the latest firmware version (V2.4.24 or later) to mitigate the risk. Exploitation of this vulnerability could allow attackers to alter device configurations, potentially disrupting industrial processes or enabling further attacks within operational technology environments. The vulnerability is considered critical due to the widespread use of these modules in industrial automation and the potential impact on critical infrastructure. Security researchers have highlighted the risk of remote exploitation, emphasizing the need for immediate patching and network segmentation to protect vulnerable devices. Organizations are advised to review their asset inventories to identify affected devices and prioritize remediation efforts. In addition to patching, Siemens recommends implementing network security best practices, such as restricting access to configuration interfaces and monitoring for unauthorized connection attempts. The disclosure of CVE-2025-40771 underscores the ongoing challenges in securing industrial control systems against remote attacks. The vulnerability was publicly disclosed in mid-October 2025, and security advisories have been disseminated to raise awareness among industrial operators. The incident highlights the importance of timely vulnerability management and the need for robust authentication mechanisms in critical infrastructure devices. Failure to address this vulnerability could result in significant operational disruptions and potential safety risks in industrial environments. The security community continues to monitor for signs of exploitation in the wild, and organizations are encouraged to stay informed about further updates from Siemens and relevant CERTs.
Jun 29, 2026
Advantech released security updates for **EKI-series industrial wireless access points** after researchers disclosed **20 vulnerabilities**, including **six critical flaws** tracked as `CVE-2024-50370` through `CVE-2024-50375`. The most severe issues affect over-the-air functionality and can let a **remote, unauthenticated attacker** bypass authentication, execute arbitrary code as **root**, and take full control of exposed devices. The affected products are **EKI-6333AC-2G** and **EKI-6333AC-2GD** running firmware earlier than **v1.6.5**, and **EKI-6333AC-1GPO** running firmware earlier than **v1.2.2**. Additional high-severity weaknesses could enable **cross-site scripting**, **system command injection**, **denial of service**, and unauthorized access to sensitive data. Defenders are advised to **immediately upgrade firmware** to the vendor-fixed versions and review internet-exposed or operational technology deployments using these access points.
Jul 24, 2026