PT-2026-7597 · Metis Wic · Metis Wic

Or Balog · Publicado 2026-02-11 · Atualizado 2026-02-11 · CVE-2026-2248

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions METIS WIC versions oscore 2.1.234-r18 and earlier

Description METIS WIC devices expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges, resulting in full system compromise. This allows unauthorized access to modify system configuration, read sensitive data, or disrupt device operations.

Recommendations Versions prior to oscore 2.1.234-r18 should be updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Improper Authentication

Enumeração de Fraquezas

CWE-306

CWE-287

Identificadores relacionados

CVE-2026-2248

Produtos afetados

Metis Wic

Referências · 6

• https://twitter.com/CveFindCom/status/2021618115730157665 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2248 · Nota de Segurança
• https://cydome.io/vulnerability-advisory-cve-2026-2248-unauthenticated-remote-root-shell-in-metis-wic · Nota
• https://twitter.com/TheHackerWire/status/2021617487985668441 · Publicação no Twitter
• https://metis.tech · Nota
• https://twitter.com/CVEnew/status/2021608565060878613 · Publicação no Twitter