Description

The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mode enabled, causing malformed requests to return verbose Django tracebacks that disclose backend source code, local file paths, and system configuration.

INFO

Published Date :

2026-02-11T14:13:45.892Z

Last Modified :

2026-02-12T15:20:51.492Z

Source :

MHV
AFFECTED PRODUCTS

The following products are affected by CVE-2026-2250 vulnerability.

Vendors Products
Metis Cyberspace Technology Sa
  • Metis Wic
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-2250.

URL Resource
https://cydome.io/vulnerability-advisory-cve-2026-2250-unauthenticated-data-exfilteration-and-information-disclosure-in-metis-wic-wireless-intelligent-collector cve-icon cve-icon
https://www.metis.tech/ cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact