Unauthenticated Remote Command Execution via Web Console in METIS DFS

The exposed web-based shell at the /console endpoint provides a direct pathway for remote code execution (RCE). An attacker can leverage this vulnerability to gain 'daemon' level privileges, effectively controlling the METIS DFS device. This allows for a wide range of malicious activities, including reading and modifying configuration files, exfiltrating sensitive data stored on the device, disrupting services, and potentially pivoting to other systems on the network. Given the lack of authentication, the vulnerability is easily exploitable and poses a significant risk to organizations relying on METIS DFS for data storage and management.

Organizations utilizing METIS DFS devices in environments with limited network segmentation are particularly at risk. Shared hosting environments where multiple customers share the same METIS DFS instance are also vulnerable. Legacy deployments using older, unpatched versions of METIS DFS are especially susceptible.

• linux / server:

journalctl -u metisdfs | grep /console

• linux / server:

ss -tulnp | grep /console

• generic web:

curl -I <METIS_DFS_IP>/console

• generic web:

grep -r /console /var/log/apache2/access.log

1. 2026-02-11Disclosure

   disclosure

1. 已保留2026-02-09
2. 发布日期2026-02-11
3. 修改日期2026-02-12
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-2249 is to immediately upgrade METIS DFS devices to version 2.1.236 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting network access to the /console endpoint using firewalls or access control lists. While not a complete solution, this can reduce the attack surface. Monitor network traffic for suspicious activity targeting the /console endpoint. After upgrading, confirm the vulnerability is resolved by attempting to access the /console endpoint and verifying that authentication is required.