CVE-2026-2250 Unauthenticated Data Export and Source Code Disclosure via /dbviewer/ in METIS WIC
Unauthenticated attackers can access the /dbviewer/ endpoint to export sensitive telemetry data and view source code via debug tracebacks in METIS WIC devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2250?
CVE-2026-2250 is a high-severity vulnerability in METIS WIC, published on 11 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mode enabled, causing malformed requests to return verbose Django tracebacks that disclose backend source code, local file paths, and system configuration.
Which versions are affected by CVE-2026-2250?
How do I fix CVE-2026-2250?
No fix has been published for CVE-2026-2250 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-2250 being exploited?
There is no known exploitation of CVE-2026-2250 in the wild and no public exploit code.
Sources
Also known as GHSA-fmxw-gfwm-67w3.