METIS DFS Devices Web-Based Shell Vulnerability Allowing Arbitrary Command Execution

A vulnerability exists in METIS DFS devices running operating system version 2.1.234-r18 or earlier. These devices expose a web-based shell at the '/console' endpoint, which does not require authentication. This vulnerability allows remote attackers to execute arbitrary operating system commands with 'daemon' privileges. The exploitation of this issue could compromise the device's software, unauthorizedly modify configurations, access and alter sensitive data, or disrupt services.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of commands with 'daemon' privileges, allowing attackers to modify configurations, access and alter sensitive data, disrupt services, and potentially compromise the device's software integrity.