CVE-2026-2250
Unauthorized Access and Information Disclosure in METIS WIC /dbviewer Endpoint
Publication date: 2026-02-11
Last updated on: 2026-02-12
Assigner: MHV
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| metis | wireless_intelligent_collector | to 2.1.235-r19 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-215 | The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the /dbviewer/ web endpoint of METIS WIC devices, which is accessible without any authentication. This allows a remote attacker to access and export the internal telemetry SQLite database that contains sensitive operational data.
Additionally, the application is running in debug mode, which causes malformed requests to return detailed Django tracebacks. These tracebacks reveal backend source code, local file paths, and system configuration information.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive operational data stored in the telemetry SQLite database.
The exposure of detailed debug information such as backend source code, file paths, and system configuration can aid attackers in further exploiting the system or understanding its internal workings.
Overall, this can compromise the confidentiality of the device's data and potentially facilitate further attacks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know