METZ CONNECT EWIO2 Series PHP Module Source Code Disclosure Vulnerability

A vulnerability exists in METZ CONNECT EWIO2 series devices, specifically in the Energy-Controlling EWIO2-M, EWIO2-M-BM, and Ethernet-IO EWIO2-BM models, all running firmware prior to 2.2.0. Due to a web server misconfiguration, an unauthenticated remote attacker can read the source code of PHP modules on these devices.

Impact

Exploitation of this vulnerability allows for unauthorized access to the source code of PHP modules, which could lead to further attacks or exploitation of the device.

Remediation

Users are advised to update to version 2.2.0 or later. Schedule the update during the next maintenance window.