CVE-2026-2250

Feb. 11, 2026, 3:27 p.m.

7.5
High

Description

The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mode enabled, causing malformed requests to return verbose Django tracebacks that disclose backend source code, local file paths, and system configuration.

Product(s) Impacted

Vendor Product Versions
Metis
  • Wic
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-215
Insertion of Sensitive Information Into Debugging Code
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a metis wic / / / / / / / /

References

https://www.metis.tech/

Tags

CWE-215
56a186b1-7f5e-4314-ba38-38d5499fccfd
2026-02-11
CVE-2026-2250

CVSS Score

7.5 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: NONE
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

    View Vector String

Timeline

Published: Feb. 11, 2026, 3:16 p.m.
Last Modified: Feb. 11, 2026, 3:27 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

56a186b1-7f5e-4314-ba38-38d5499fccfd

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.