CVE-2026-2249
Unauthenticated Remote Command Execution in METIS DFS /console Endpoint
Publication date: 2026-02-11
Last updated on: 2026-02-12
Assigner: MHV
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| metis | dfs | to 2.1.234-r18 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects METIS DFS devices running oscore version 2.1.234-r18 or earlier. These devices expose a web-based shell at the /console endpoint that does not require any authentication.
Because there is no authentication, a remote attacker can access this shell and execute arbitrary operating system commands with 'daemon' privileges.
This means the attacker can compromise the software, allowing unauthorized modification of configurations, reading and altering sensitive data, or disrupting services.
How can this vulnerability impact me? :
The vulnerability can have severe impacts including unauthorized access to the device's software and data.
- Attackers can modify device configurations, potentially disrupting normal operations.
- Sensitive data can be read or altered by unauthorized parties.
- Services provided by the device can be disrupted, leading to operational downtime.
Given the high CVSS score of 9.8, this vulnerability represents a critical security risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the METIS DFS device exposes a web-based shell at the /console endpoint without requiring authentication.
You can attempt to access the /console endpoint on the device's IP address using tools like curl or a web browser to see if it is accessible without authentication.
- curl -v http://<device-ip>/console
- curl -v --head http://<device-ip>/console
- Using a web browser to navigate to http://<device-ip>/console and checking if a shell interface or command prompt is presented without login.
If the endpoint is accessible and allows command execution, the device is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /console endpoint to trusted networks only, such as by implementing firewall rules or network segmentation.
If possible, disable or remove the web-based shell feature on affected METIS DFS devices running oscore versions <= 2.1.234-r18.
Apply any available patches or updates from the vendor that address this vulnerability.
Monitor device logs and network traffic for any unauthorized access attempts to the /console endpoint.