CVE-2026-2250: METIS WIC · Improper Access Control
Affects METIS WICSource CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 41% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 11 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| METIS Cyberspace Technology SAMETIS WIC | Affected
| Fixed in– |
AI-suggested
1. Immediately disable debug mode in the METIS WIC application configuration to prevent verbose error messages and traceback disclosures. 2. Restrict access to the /dbviewer/ endpoint by implementing strong authentication mechanisms, such as multi-factor authentication or integration with enterprise identity providers. 3. Use network segmentation and firewall rules to limit access to the management interfaces of METIS WIC devices only to trusted administrative networks. 4. Monitor network traffic and logs for any unauthorized access attempts to the /dbviewer/ endpoint or unusual export activity of telemetry data. 5. Engage with METIS Cyberspace Technology SA to obtain patches or updates addressing this vulnerability and apply them promptly once available. 6. Conduct a thorough security review of all METIS WIC deployments to identify any other misconfigurations or exposure risks. 7. Implement intrusion detection/prevention systems (IDS/IPS) tuned to detect exploitation attempts targeting this vulnerability. 8. Educate operational and security teams about the risks of running production systems in debug mode and enforce secure configuration baselines.
Description
The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mode enabled, causing malformed requests to return verbose Django tracebacks that disclose backend source code, local file paths, and system configuration.