CVE-2026-2249 - Unauthenticated Remote Command Execution via Web Console in METIS DFS

Back Back to CVE browser

CRITICAL

Unauthenticated Remote Command Execution via Web Console in METIS DFS

Published Feb 11, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.55%

Description

METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.

Affected products

Vendor METIS Cyberspace Technology SA Product Metis Dfs Default
unaffected
- Version
  oscore 2.1.234-r18
  Status
  affected
  Constraints
  -
- Version
  oscore 2.1.235-r19
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

METIS Cyberspace Technology SA

Metis Dfs

unaffected

Version	Status	Constraints
oscore 2.1.234-r18	affected	-
oscore 2.1.235-r19	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-287

Improper Authentication

CWE-306

Missing Authentication

References (3)

https://cydome.io/vulnerability-advisory-cve-2026-2249-unauthenticated-rce-in-metis-data-fusion-server-dfs
technical-description
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-7029
Advisory
https://www.metis.tech/
x_vendor-website

Link	Providers	Tags
https://cydome.io/vulnerability-advisory-cve-2026-2249-unauthenticated-rce-in-metis-data-fusion-server-dfs		technical-description
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-7029		Advisory
https://www.metis.tech/		x_vendor-website