Critical severity · published Feb 11, 2026
CVE-2026-2248
Unauthenticated Remote Root Shell Access via Web Console in METIS WIC
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges. This results in full system compromise, allowing unauthorized access to modify system configuration, read sensitive data, or disrupt device operations
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MW
METIS WIC · METIS Cyberspace Technology SA
oscore 2.1.234-r18 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2248
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2248
cydome.io
https://cydome.io/vulnerability-advisory-cve-2026-2248-unauthenticated-remote-root-shell-in-metis-wic
www.metis.tech
https://www.metis.tech/
More from METIS WIC
7.5
CVE-2026-2250
Unauthenticated Data Export and Source Code Disclosure via /dbviewer/ in METIS WIC