METIS WIC Devices Unauthenticated Database Access Vulnerability

A vulnerability exists in METIS WIC devices, where the /dbviewer/ web endpoint is accessible without authentication. This flaw allows remote attackers to access and export the internal telemetry SQLite database, which contains sensitive operational data. Furthermore, the application runs in debug mode, causing malformed requests to generate detailed Django error messages that reveal backend source code, local file paths, and system configuration.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive operational data stored in the telemetry SQLite database. Additionally, the debug mode exposure could allow attackers to gain insights into the application's backend, potentially facilitating further attacks.