Riskcovery

CVE-2026-2250

Unauthenticated Data Export and Source Code Disclosure via /dbviewer/ in METIS WIC

State
Published
Severity
7.5 High
Published
Feb 11, 2026
Updated
Feb 12, 2026
Reserved
Feb 9, 2026

Read the record on cve.org

Description

The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mode enabled, causing malformed requests to return verbose Django tracebacks that disclose backend source code, local file paths, and system configuration.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NMHV

Weaknesses

  • CWE-284 Improper Access Control
  • CWE-215 Insertion of Sensitive Information Into Debugging Error Output

Affected Products

ProductVersions
METIS WICMETIS Cyberspace Technology SA
  • oscore 2.1.234-r18Affected
  • oscore 2.1.235-r19Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.