METIS WIC CVE-2026-2250 Unauthenticated DB Exfiltration and Source Code Disclosure

Key Information Summary CVE ID: CVE-2026-2250 CVSS 3.1 Score: 7.5 CWE: - Improper Access Control (CWE-284) - Debug Mode Enabled (CWE-215) Affected Products: METIS Wireless Intelligent Collector Affected Firmware: oscore 2.1.234-r18 and earlier Affected Systems METIS WIC in Maritime IoT Networks: - Critical device for the maritime industry. - Transmits data via ZigBee or Ethernet to the METIS Data Fusion Server. Root Cause Analysis Improper Access Control (CWE-284): endpoint lacks authentication middleware. Debug Mode Enabled in Production (CWE-215): Production firmware is deployed with . Attack Vector & Exploitation Path (PoC) Unauthenticated Database Exfiltration: - An attacker can identify and export telemetry tables via interface. - Proof of Concept: Extracts . Source Code Disclosure via Debug Traceback: - Sends request with invalid parameters to trigger an unhandled exception. - Proof of Concept: Reveals internal source code, paths, and vulnerable logic. Impact Assessment CVSS 3.1 Score: 7.5 (High) Confidentiality (High): Complete exposure of telemetry databases and backend code. Integrity & Availability: No direct impact, but exposure facilitates subsequent attacks. Remediation & Patching Instructions Apply Official Patch: Upgrade firmware to version or later. Network Segmentation & Hardening: Isolate WIC devices within a secure VLAN.

Goal Reached Thanks to every supporter — we hit 100%!

METIS WIC CVE-2026-2250 Unauthenticated DB Exfiltration and Source Code Disclosure