CVE-2026-2249

CRITICAL

METIS DFS <oscore 2.1.234-r18 - RCE

Title source: llm

Description

METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.

Exploits (2)

github SUSPICIOUS 10 stars
by XiaomingX · pythonpoc
https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-2249
nomisec WRITEUP 3 stars
by taylorwerno · poc
https://github.com/taylorwerno/CVE-2026-2249

References (2)

Scores

CVSS v3 9.8
EPSS 0.0030
EPSS Percentile 53.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-287 CWE-306
Status published
Products (2)
METIS Cyberspace Technology SA/METIS DFS oscore 2.1.234-r18
METIS Cyberspace Technology SA/METIS DFS oscore 2.1.235-r19
Published Feb 11, 2026
Tracked Since Feb 18, 2026