A web-based shell is exposed at the /console endpoint of METIS DFS devices. The endpoint is accessible without authentication, allowing a remote attacker to execute arbitrary operating system commands with daemon privileges. This flaw aligns with authentication and authorization weaknesses (CWE‑287, CWE‑306) and can lead to full compromise of the device, unauthorized configuration changes, data theft, and service disruption.

The vulnerability affects METIS Cyberspace Technology SA’s METIS DFS products, specifically versions having OS core 2.1.234‑r18 or earlier. Devices running these legacy firmware releases are susceptible.

The flaw carries a CVSS score of 9.8, indicating critical severity. The current EPSS score of less than 1 % reflects a low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a connection to the web interface; attackers can send crafted requests to /console, manipulate command execution, and gain undue control over the system. Given the lack of authentication, the attack vector is highly feasible for any adversary with network access to the device.