Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
[CVE-2026-2249: CRITICAL] Critical security vulnerability in METIS DFS devices <= oscore 2.1.234-r18 exposes an unauthenticated web shell, allowing attackers to run OS commands with high privileges remotely.#cve,CVE-2026-2249,#cybersecurity https://cvefind.com/CVE-2026-2249
Post summary
Critical vulnerability CVE‑2026‑2249 in METIS DFS devices enables unauthenticated remote web shell with high‑privilege command execution.
🔴 CVE-2026-2249 - Critical METIS DFS devices (versions &lt;= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attack... https://www.thehackerwire.com/vulnerability/CVE-2026-2249/ https://t.co/krqtQbpbLz
Post summary
The tweet highlights CVE‑2026‑2249 as a critical flaw in METIS DFS devices, exposing an unauthenticated web shell via the /console endpoint, but it provides no exploit code, patch info, or evidence of active attacks.
CVE-2026-2249 METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allow… https://www.cve.org/CVERecord?id=CVE-2026-2249
Post summary
CVE‑2026‑2249 exposes an unauthenticated web shell via the /console endpoint on affected METIS DFS devices.