PT-2026-7597 · Metis Wic · Metis Wic

Or Balog · Published 2026-02-11 · Updated 2026-02-11 · CVE-2026-2248

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions METIS WIC versions oscore 2.1.234-r18 and earlier

Description METIS WIC devices expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges, resulting in full system compromise. This allows unauthorized access to modify system configuration, read sensitive data, or disrupt device operations.

Recommendations Versions prior to oscore 2.1.234-r18 should be updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2026-2248

Affected Products

Metis Wic

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2248 · Security Note
• https://twitter.com/CveFindCom/status/2021618115730157665 · Twitter Post
• https://cydome.io/vulnerability-advisory-cve-2026-2248-unauthenticated-remote-root-shell-in-metis-wic · Note
• https://twitter.com/TheHackerWire/status/2021617487985668441 · Twitter Post
• https://metis.tech · Note
• https://twitter.com/CVEnew/status/2021608565060878613 · Twitter Post