CVEvulnerability

CVE-2026-2250

7.5 HIGH Published 2026-02-11 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2026-02-11
Last modified
2026-06-17
Assigner
56a186b1-7f5e-4314-ba38-38d5499fccfd
CVSS 3.1 (56a186b1-7f5e-4314-ba38-38d5499fccfd)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-215, CWE-284

Description

The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mode enabled, causing malformed requests to return verbose Django tracebacks that disclose backend source code, local file paths, and system configuration.

Related

Weakness · CWE (2)

  • CWE-215 Insertion of Sensitive Information Into Debugging Code weakness
  • CWE-284 Improper Access Control weakness

References