CVE-2026-2250
Awaiting Analysis Awaiting Analysis - Queue

Unauthorized Access and Information Disclosure in METIS WIC /dbviewer Endpoint

Publication date: 2026-02-11

Last updated on: 2026-02-12

Assigner: MHV

Description
The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mode enabled, causing malformed requests to return verbose Django tracebacks that disclose backend source code, local file paths, and system configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-11
Last Modified
2026-02-12
Generated
2026-07-06
AI Q&A
2026-02-11
EPSS Evaluated
2026-07-05
NVD
CVE-2026-2250

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
metis wireless_intelligent_collector to 2.1.235-r19 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-215 The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability exists in the /dbviewer/ web endpoint of METIS WIC devices, which is accessible without any authentication. This allows a remote attacker to access and export the internal telemetry SQLite database that contains sensitive operational data.

Additionally, the application is running in debug mode, which causes malformed requests to return detailed Django tracebacks. These tracebacks reveal backend source code, local file paths, and system configuration information.

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive operational data stored in the telemetry SQLite database.

The exposure of detailed debug information such as backend source code, file paths, and system configuration can aid attackers in further exploiting the system or understanding its internal workings.

Overall, this can compromise the confidentiality of the device's data and potentially facilitate further attacks.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2250. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart