CVE-2026-2248

Unauthenticated Remote Root Shell Access via Web Console in METIS WIC

State: Published
Severity: 9.8 Critical
Published: Feb 11, 2026
Updated: Feb 12, 2026
Reserved: Feb 9, 2026

Description

METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges. This results in full system compromise, allowing unauthorized access to modify system configuration, read sensitive data, or disrupt device operations

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	MHV

Weaknesses

CWE-306 Missing Authentication for Critical Function
CWE-287 Improper Authentication

Affected Products

Product	Versions
METIS WICMETIS Cyberspace Technology SA	oscore 2.1.234-r18Affected oscore 2.1.235-r19Not affected

References

https://www.metis.tech/
https://cydome.io/vulnerability-advisory-cve-2026-2248-unauthenticated-remote-root-shell-in-metis-wictechnical-description

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.