METIS DFS devices contain a critical vulnerability where an unauthenticated attacker can remotely execute commands to modify configurations and disrupt services.

The software exposes a web-based shell via the /console endpoint that fails to require authentication. This allows a remote, unauthenticated attacker to execute arbitrary OS commands with the privileges of the 'daemon' user.

Exploitation of this flaw allows an attacker to gain unauthorized access to the device's internal functions, leading to the potential alteration of sensitive data and disruption of services. While the privileges are limited to 'daemon' rather than 'root', the CVSS score of 9.8 underscores the high risk of service disruption and further lateral movement within the network.

Immediate Action: Apply the latest firmware updates from METIS to remediate the unauthenticated access to the console interface.

Proactive Monitoring: Implement logging for all administrative endpoint access and alert on any non-standard command execution patterns originating from the web server process.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block access to the /console endpoint from untrusted IP addresses and internal segments.

Public Exploit Available: No

The ability to execute commands without authentication poses an immediate threat to the integrity of DFS devices. It is highly recommended to update the firmware immediately. Organizations should also verify that management interfaces are not reachable from the public internet to mitigate the threat of remote discovery.