CVE-2026-2249 Unauthenticated Remote Command Execution via Web Console in METIS DFS
Remote attackers can execute arbitrary OS commands on METIS DFS devices via an unauthenticated web console, leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2249?
CVE-2026-2249 is a critical command injection vulnerability in METIS DFS, published on 11 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.
Which versions are affected by CVE-2026-2249?
How do I fix CVE-2026-2249?
No fix has been published for CVE-2026-2249 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-2249 being exploited?
There is no known exploitation of CVE-2026-2249 in the wild and no public exploit code.
Sources
Also known as GHSA-3x5q-gxp5-wv27.