PT-2026-7598 · Metis Dfs · Metis Dfs

Or Balog · Published 2026-02-11 · Updated 2026-02-11 · CVE-2026-2249

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions METIS DFS versions prior to oscore 2.1.234-r18

Description METIS DFS devices expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges, resulting in the compromise of the software and granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.

Recommendations For versions prior to oscore 2.1.234-r18, restrict access to the /console endpoint. For versions prior to oscore 2.1.234-r18, disable the web-based shell if it is not required.

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2026-2249

Affected Products

Metis Dfs

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2249 · Security Note
• https://twitter.com/TheHackerWire/status/2021617536983585030 · Twitter Post
• https://twitter.com/CveFindCom/status/2021618066161819935 · Twitter Post
• https://twitter.com/CVEnew/status/2021608563353817317 · Twitter Post
• https://cydome.io/vulnerability-advisory-cve-2026-2249-unauthenticated-rce-in-metis-data-fusion-server-dfs · Note
• https://metis.tech · Note