CVE-2026-2249

CRITICAL

METIS DFS <oscore 2.1.234-r18 - RCE

Title source: llm

Description

METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.

Exploits (2)

github SUSPICIOUS 10 stars

by XiaomingX · pythonpoc

https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-2249

View Code ZIP pw:eip

nomisec WRITEUP 3 stars

by taylorwerno · poc

https://github.com/taylorwerno/CVE-2026-2249

View on nomisec

References (2)

[Various Sources] https://cydome.io/vulnerability-advisory-cve-2026-2249-unauthenticated-rce-in-metis-data-fusion-server-dfs

[Various Sources] https://www.metis.tech/

Scores

CVSS v3 9.8

EPSS 0.0026

EPSS Percentile 49.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-306 CWE-287

Status draft

Timeline

Published Feb 11, 2026

Tracked Since Feb 18, 2026