CVE-2026-2249
Published: 11 February 2026
Summary
CVE-2026-2249 is a critical-severity Improper Authentication (CWE-287) vulnerability in Cydome (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-2249 is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in METIS DFS devices running oscore versions up to 2.1.234-r18. It stems from an exposed web-based shell at the /console endpoint that requires no authentication (CWE-287: Improper Authentication, CWE-306: Missing Authentication for Critical Function). This allows remote attackers to execute arbitrary operating system commands with daemon privileges, leading to full software compromise.
Remote attackers with network access can exploit this vulnerability without user interaction, privileges, or special conditions. Exploitation grants unauthorized control, enabling attackers to modify device configurations, read and alter sensitive data, or disrupt services entirely.
Mitigation guidance is detailed in advisories such as the Cydome vulnerability advisory at https://cydome.io/vulnerability-advisory-cve-2026-2249-unauthenticated-rce-in-metis-data-fusion-server-dfs, with additional information available on the vendor site at https://www.metis.tech/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7029
Vulnerability details
METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the…
more
compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability exposes an unauthenticated web-based shell (/console) on a public-facing METIS DFS device, enabling remote code execution with daemon privileges. This directly maps to T1190 (Exploit Public-Facing Application), T1210 (Exploitation of Remote Services), and T1100 (Web Shell).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-14 identifies and authorizes only approved actions without authentication while monitoring and reviewing them, directly preventing exposure of the unauthenticated /console web shell.
AC-3 enforces approved access authorizations, requiring authentication to block remote unauthorized access to the command execution shell.
CM-7 least functionality restricts the system to essential capabilities, prohibiting or disabling the unnecessary exposed web shell endpoint.