CVE-2026-2249
Awaiting Analysis Awaiting Analysis - Queue
Unauthenticated Remote Command Execution in METIS DFS /console Endpoint

Publication date: 2026-02-11

Last updated on: 2026-02-12

Assigner: MHV

Description
METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-11
Last Modified
2026-02-12
Generated
2026-06-16
AI Q&A
2026-02-11
EPSS Evaluated
2026-06-14
NVD
CVE-2026-2249
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
metis dfs to 2.1.234-r18 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects METIS DFS devices running oscore version 2.1.234-r18 or earlier. These devices expose a web-based shell at the /console endpoint that does not require any authentication.

Because there is no authentication, a remote attacker can access this shell and execute arbitrary operating system commands with 'daemon' privileges.

This means the attacker can compromise the software, allowing unauthorized modification of configurations, reading and altering sensitive data, or disrupting services.

Impact Analysis

The vulnerability can have severe impacts including unauthorized access to the device's software and data.

  • Attackers can modify device configurations, potentially disrupting normal operations.
  • Sensitive data can be read or altered by unauthorized parties.
  • Services provided by the device can be disrupted, leading to operational downtime.

Given the high CVSS score of 9.8, this vulnerability represents a critical security risk.

Compliance Impact

I don't know

Detection Guidance

This vulnerability can be detected by checking if the METIS DFS device exposes a web-based shell at the /console endpoint without requiring authentication.

You can attempt to access the /console endpoint on the device's IP address using tools like curl or a web browser to see if it is accessible without authentication.

  • curl -v http://<device-ip>/console
  • curl -v --head http://<device-ip>/console
  • Using a web browser to navigate to http://<device-ip>/console and checking if a shell interface or command prompt is presented without login.

If the endpoint is accessible and allows command execution, the device is vulnerable.

Mitigation Strategies

Immediate mitigation steps include restricting access to the /console endpoint to trusted networks only, such as by implementing firewall rules or network segmentation.

If possible, disable or remove the web-based shell feature on affected METIS DFS devices running oscore versions <= 2.1.234-r18.

Apply any available patches or updates from the vendor that address this vulnerability.

Monitor device logs and network traffic for any unauthorized access attempts to the /console endpoint.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2249. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart