Vulnerability · Published Feb 11, 2026 · Assigned by MHV

CVE-2026-2248Unauthenticated Remote Root Shell Access via Web Console in METIS WIC

Critical 9.8

In plain English

A critical-severity missing authentication in METIS WIC from METIS Cyberspace Technology SA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 51.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges. This results in full system compromise, allowing unauthorized access to modify system configuration, read sensitive data, or disrupt device operations

Affected products (as reported)

Vendor	Product	Versions
METIS Cyberspace Technology SA	METIS WIC	oscore 2.1.234-r18

Weakness: CWE-306, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.metis.tech/ x_vendor-website
https://cydome.io/vulnerability-advisory-cve-2026-2248-unauthenticated-remote-root-shell-in-metis-wic technical-description