A critical remote code execution vulnerability in METZ CONNECT devices allows authenticated attackers to upload malicious files to arbitrary locations.

This vulnerability is classified as CWE-434, representing an unrestricted upload of files with dangerous types. The flaw exists because the application fails to perform necessary file type and path validation, allowing an authenticated user with low privileges to upload files to unauthorized locations and achieve remote code execution.

The ability for an attacker to execute arbitrary code on these industrial control components presents a severe risk to operational integrity. A successful exploit could result in full system compromise, unauthorized access to sensitive operational data, and potential disruption of industrial processes, justifying the high CVSS score of 8.8.

Immediate Action: Update the affected METZ CONNECT firmware to version 2.2.0 or later as specified by the vendor advisory.

Proactive Monitoring: Review system access logs for unusual file upload activity or unexpected file creation events in directories not intended for user-supplied content.

Compensating Controls: Restrict network access to the affected devices by placing them behind a firewall and limiting management interface access to trusted administrative subnets only.

Public Exploit Available: No

Given the potential for complete system takeover, administrators should prioritize updating these industrial components to version 2.2.0 immediately. If patching is not immediately feasible, ensure that all access to the management interfaces of these devices is strictly segmented from the broader network to minimize the risk of unauthorized access.