Riskcovery

CVE-2026-2249

Unauthenticated Remote Command Execution via Web Console in METIS DFS

State
Published
Severity
9.8 Critical
Published
Feb 11, 2026
Updated
Feb 12, 2026
Reserved
Feb 9, 2026

Read the record on cve.org

Description

METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HMHV

Weaknesses

  • CWE-306 Missing Authentication for Critical Function
  • CWE-287 Improper Authentication

Affected Products

ProductVersions
METIS DFSMETIS Cyberspace Technology SA
  • oscore 2.1.234-r18Affected
  • oscore 2.1.235-r19Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.