CVE-2026-2249

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2249", "assignerOrgId": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "state": "PUBLISHED", "assignerShortName": "MHV", "dateReserved": "2026-02-09T13:38:43.331Z", "datePublished": "2026-02-11T14:16:19.157Z", "dateUpdated": "2026-02-12T15:20:28.314Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "METIS DFS", "vendor": "METIS Cyberspace Technology SA", "versions": [{"status": "affected", "version": "oscore 2.1.234-r18", "versionType": "custom"}, {"status": "unaffected", "version": "oscore 2.1.235-r19", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Cydome Security Ltd"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>METIS DFS devices (versions &lt;= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.</p>"}], "value": "METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "shortName": "MHV", "dateUpdated": "2026-02-12T15:20:28.314Z"}, "references": [{"tags": ["x_vendor-website"], "url": "https://www.metis.tech/"}, {"tags": ["technical-description"], "url": "https://cydome.io/vulnerability-advisory-cve-2026-2249-unauthenticated-rce-in-metis-data-fusion-server-dfs"}], "source": {"discovery": "INTERNAL"}, "title": "Unauthenticated Remote Command Execution via Web Console in METIS DFS", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T14:47:17.943059Z", "id": "CVE-2026-2249", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T14:48:28.435Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2249", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T14:47:17.943059Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T14:47:24.501Z"}}], "cna": {"title": "Unauthenticated Remote Command Execution via Web Console in METIS DFS", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Cydome Security Ltd"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "METIS Cyberspace Technology SA", "product": "METIS DFS", "versions": [{"status": "affected", "version": "oscore 2.1.234-r18", "versionType": "custom"}, {"status": "unaffected", "version": "oscore 2.1.235-r19", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.metis.tech/", "tags": ["x_vendor-website"]}, {"url": "https://cydome.io/vulnerability-advisory-cve-2026-2249-unauthenticated-rce-in-metis-data-fusion-server-dfs", "tags": ["technical-description"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.", "supportingMedia": [{"type": "text/html", "value": "<p>METIS DFS devices (versions &lt;= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "shortName": "MHV", "dateUpdated": "2026-02-12T15:20:28.314Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2249", "state": "PUBLISHED", "dateUpdated": "2026-02-12T15:20:28.314Z", "dateReserved": "2026-02-09T13:38:43.331Z", "assignerOrgId": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "datePublished": "2026-02-11T14:16:19.157Z", "assignerShortName": "MHV"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "METIS DFS", "vendor": "METIS Cyberspace Technology SA", "versions": [{"status": "affected", "version": "oscore 2.1.234-r18", "versionType": "custom"}, {"status": "unaffected", "version": "oscore 2.1.235-r19", "versionType": "custom"}]}], "source": "56a186b1-7f5e-4314-ba38-38d5499fccfd"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services."}, {"lang": "es", "value": "Dispositivos METIS DFS (versiones &lt;= oscore 2.1.234-r18) exponen un shell basado en web en el endpoint /console que no requiere autenticaci\u00f3n. Acceder a este endpoint permite a un atacante remoto ejecutar comandos arbitrarios del sistema operativo con privilegios de 'daemon'. Esto resulta en el compromiso del software, otorgando acceso no autorizado para modificar la configuraci\u00f3n, leer y alterar datos sensibles, o interrumpir servicios."}], "id": "CVE-2026-2249", "lastModified": "2026-06-17T10:30:37.823", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2249", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T14:47:17.943059Z", "version": "2.0.3"}}]}, "published": "2026-02-11T15:16:17.600", "references": [{"source": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "url": "https://cydome.io/vulnerability-advisory-cve-2026-2249-unauthenticated-rce-in-metis-data-fusion-server-dfs"}, {"source": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "url": "https://www.metis.tech/"}], "sourceIdentifier": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-306"}], "source": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "oscore 2.1.234-r18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "oscore 2.1.235-r19"}}], "product": "metis_dfs", "vendor": "metis_cyberspace_technology_sa"}], "analysis": {"en": {"generated_at": "2026-04-18T12:40:35.749993+00:00", "value": {"mitigation_remediation": ["Upgrade METIS DFS to a version newer than OS core 2.1.234\u2011r18 to eliminate the unauthenticated web console", "Configure network controls (firewall or ACL) to limit access to the /console endpoint to trusted IP addresses only", "Disable or remove the web console feature entirely if it is not required for normal operation"], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated Remote Command Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects METIS Cyberspace Technology SA\u2019s METIS DFS products, specifically versions having OS core 2.1.234\u2011r18 or earlier. Devices running these legacy firmware releases are susceptible.", "description_and_impact": "A web-based shell is exposed at the /console endpoint of METIS DFS devices. The endpoint is accessible without authentication, allowing a remote attacker to execute arbitrary operating system commands with daemon privileges. This flaw aligns with authentication and authorization weaknesses (CWE\u2011287, CWE\u2011306) and can lead to full compromise of the device, unauthorized configuration changes, data theft, and service disruption.", "risk_and_exploitability": "The flaw carries a CVSS score of 9.8, indicating critical severity. The current EPSS score of less than 1\u202f% reflects a low but non\u2011zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a connection to the web interface; attackers can send crafted requests to /console, manipulate command execution, and gain undue control over the system. Given the lack of authentication, the attack vector is highly feasible for any adversary with network access to the device."}}}}, "created": "2026-02-11T21:38:06.823517+00:00", "updated": "2026-04-18T12:45:45.671247+00:00", "vendors": ["metis_cyberspace_technology_sa", "metis_cyberspace_technology_sa$PRODUCT$metis_dfs"]}