CVEvulnerability

CVE-2026-2248

9.8 CRITICAL Published 2026-02-11 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2026-02-11
Last modified
2026-06-17
Assigner
56a186b1-7f5e-4314-ba38-38d5499fccfd
CVSS 3.1 (56a186b1-7f5e-4314-ba38-38d5499fccfd)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-306

Description

METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges. This results in full system compromise, allowing unauthorized access to modify system configuration, read sensitive data, or disrupt device operations

Related

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References