PT-2026-7598 · Metis Dfs · Metis Dfs

Or Balog · Publicado 2026-02-11 · Atualizado 2026-02-11 · CVE-2026-2249

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions METIS DFS versions prior to oscore 2.1.234-r18

Description METIS DFS devices expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges, resulting in the compromise of the software and granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.

Recommendations For versions prior to oscore 2.1.234-r18, restrict access to the /console endpoint. For versions prior to oscore 2.1.234-r18, disable the web-based shell if it is not required.

Correção

Missing Authentication

Improper Authentication

Enumeração de Fraquezas

CWE-306

CWE-287

Identificadores relacionados

CVE-2026-2249

Produtos afetados

Metis Dfs

Referências · 6

• https://twitter.com/TheHackerWire/status/2021617536983585030 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2021618066161819935 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2021608563353817317 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2249 · Nota de Segurança
• https://cydome.io/vulnerability-advisory-cve-2026-2249-unauthenticated-rce-in-metis-data-fusion-server-dfs · Nota
• https://metis.tech · Nota