CVE-2026-2248 CRITICAL

CVE-2026-2248: Unauthenticated Remote Root Shell Access via Web Console in METIS WIC

Vendor Metis Cyberspace Technology Sa
Product METIS WIC
Weakness CWE-306 · Missing auth
Published February 11, 2026
Last update February 12, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges. This results in full system compromise, allowing unauthorized access to modify system configuration, read sensitive data, or disrupt device operations

Key dates

02Disclosure timeline

February 11, 2026 CVE published
February 12, 2026 Record updated