An unauthenticated vulnerability in METIS WIC devices allows remote attackers to exfiltrate sensitive operational data and gain insights into system internals, posing a significant risk to industrial security.

The /dbviewer/ endpoint lacks authentication, enabling unauthenticated remote attackers to export the internal SQLite database. Furthermore, the application exposes sensitive backend information, including source code and file paths, via verbose Django tracebacks generated in debug mode.

The exposure of operational telemetry data can lead to unauthorized visibility into sensitive industrial processes, potentially informing further targeted attacks. The disclosure of system configuration and source code through debug tracebacks facilitates reconnaissance for attackers, increasing the probability of successful secondary exploits. With a CVSS score of 7.5, this high severity vulnerability warrants immediate attention to prevent data compromise and maintain operational integrity.

Immediate Action: Update METIS WIC devices to oscore version 2.1.235-r19 or later to apply the necessary authentication and debug mode patches.

Proactive Monitoring: Review access logs for unauthorized requests to the /dbviewer/ path and monitor for high volumes of error responses that may indicate automated probing of the debug interface.

Compensating Controls: Implement a Web Application Firewall (WAF) to block external access to the /dbviewer/ endpoint and ensure the device is not reachable from public networks.

Public Exploit Available: No (exploit_available: unknown)

Given the exposure of sensitive telemetry and the ease with which an unauthenticated attacker can harvest system information, this vulnerability represents a high risk to environment security. Organizations utilizing METIS WIC devices must prioritize updating to the patched version immediately. If an update cannot be performed today, restrict network access to the device management interface to trusted segments only to mitigate the risk of remote discovery.