CVE-2026-2248

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2248", "assignerOrgId": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "state": "PUBLISHED", "assignerShortName": "MHV", "dateReserved": "2026-02-09T13:38:41.942Z", "datePublished": "2026-02-11T14:15:42.961Z", "dateUpdated": "2026-02-12T15:20:05.979Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "METIS WIC", "vendor": "METIS Cyberspace Technology SA", "versions": [{"status": "affected", "version": "oscore 2.1.234-r18", "versionType": "custom"}, {"status": "unaffected", "version": "oscore 2.1.235-r19", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Cydome Security Ltd"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>METIS WIC devices (versions &lt;= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges. This results in full system compromise, allowing unauthorized access to modify system configuration, read sensitive data, or disrupt device operations<br></p>"}], "value": "METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges. This results in full system compromise, allowing unauthorized access to modify system configuration, read sensitive data, or disrupt device operations"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "shortName": "MHV", "dateUpdated": "2026-02-12T15:20:05.979Z"}, "references": [{"tags": ["x_vendor-website"], "url": "https://www.metis.tech/"}, {"tags": ["technical-description"], "url": "https://cydome.io/vulnerability-advisory-cve-2026-2248-unauthenticated-remote-root-shell-in-metis-wic"}], "source": {"discovery": "INTERNAL"}, "title": "Unauthenticated Remote Root Shell Access via Web Console in METIS WIC", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T14:54:21.293377Z", "id": "CVE-2026-2248", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T14:54:45.412Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2248", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T14:54:21.293377Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T14:54:24.536Z"}}], "cna": {"title": "Unauthenticated Remote Root Shell Access via Web Console in METIS WIC", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Or Balog (Cydome Security)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "METIS Cyberspace Technology SA", "product": "METIS WIC", "versions": [{"status": "affected", "version": "oscore 2.1.234-r18", "versionType": "custom"}, {"status": "unaffected", "version": "oscore 2.1.235-r19", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.metis.tech/", "tags": ["x_vendor-website"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges. This results in full system compromise, allowing unauthorized access to modify system configuration, read sensitive data, or disrupt device operations", "supportingMedia": [{"type": "text/html", "value": "<p>METIS WIC devices (versions &lt;= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges. This results in full system compromise, allowing unauthorized access to modify system configuration, read sensitive data, or disrupt device operations<br></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "shortName": "MHV", "dateUpdated": "2026-02-11T14:15:42.961Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2248", "state": "PUBLISHED", "dateUpdated": "2026-02-11T14:54:45.412Z", "dateReserved": "2026-02-09T13:38:41.942Z", "assignerOrgId": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "datePublished": "2026-02-11T14:15:42.961Z", "assignerShortName": "MHV"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "METIS WIC", "vendor": "METIS Cyberspace Technology SA", "versions": [{"status": "affected", "version": "oscore 2.1.234-r18", "versionType": "custom"}, {"status": "unaffected", "version": "oscore 2.1.235-r19", "versionType": "custom"}]}], "source": "56a186b1-7f5e-4314-ba38-38d5499fccfd"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges. This results in full system compromise, allowing unauthorized access to modify system configuration, read sensitive data, or disrupt device operations"}, {"lang": "es", "value": "Los dispositivos METIS WIC (versiones &lt;= oscore 2.1.234-r18) exponen un shell basado en web en el endpoint /console que no requiere autenticaci\u00f3n. Acceder a este endpoint permite a un atacante remoto ejecutar comandos arbitrarios del sistema operativo con privilegios de root (UID 0). Esto resulta en un compromiso total del sistema, permitiendo el acceso no autorizado para modificar la configuraci\u00f3n del sistema, leer datos sensibles o interrumpir las operaciones del dispositivo."}], "id": "CVE-2026-2248", "lastModified": "2026-06-17T10:30:37.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2248", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T14:54:21.293377Z", "version": "2.0.3"}}]}, "published": "2026-02-11T15:16:17.433", "references": [{"source": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "url": "https://cydome.io/vulnerability-advisory-cve-2026-2248-unauthenticated-remote-root-shell-in-metis-wic"}, {"source": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "url": "https://www.metis.tech/"}], "sourceIdentifier": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-306"}], "source": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "oscore 2.1.234-r18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "oscore 2.1.235-r19"}}], "product": "metis_wic", "vendor": "metis_cyberspace_technology_sa"}], "analysis": {"en": {"generated_at": "2026-04-17T20:20:34.376867+00:00", "value": {"mitigation_remediation": ["Upgrade all affected METIS WIC devices to firmware versions newer than oscore\u00a02.1.234\u2011r18, which eliminate the unauthenticated web shell endpoint.", "Restrict network access to the device, ensuring that only trusted hosts can reach the internal management interface and the /console endpoint.", "Disable the /console endpoint through device configuration or firewall rules to block unauthenticated access until a patch is applied.", "Continuously monitor device logs for signs of unauthorized command execution and apply security patches promptly as they become available."], "summary": {"action": "Immediate Patch", "impact": "Remote Privilege Escalation to Root, full system compromise"}, "threat_synthesis": {"affected_systems": "Affected devices are METIS WIC units manufactured by METIS Cyberspace Technology\u00a0SA. Versions up to and including oscore\u00a02.1.234\u2011r18 are impacted. Users running these firmware releases should confirm compatibility and plan for an upgrade.", "description_and_impact": "CVE-2026-2248 exploits a flaw in METIS WIC devices that exposes a web\u2011based shell at the /console endpoint without requiring authentication. This allows an attacker who can reach the device over the network to run arbitrary operating system commands with root (UID\u00a00) privileges, resulting in complete control over the device, including configuration changes, data exfiltration, and service disruption. The weakness is an authentication bypass (CWE\u2011287) and missing authentication controls (CWE\u2011306).", "risk_and_exploitability": "The CVSS base score is 9.8, indicating critical severity. The EPSS score of less than 1\u202f% indicates that, at the time of analysis, the exploitation likelihood is low but not zero. The vulnerability is not listed in the CISA KEV catalog. An unauthenticated remote attacker can exploit it by sending an HTTP request to the /console endpoint from any network segment that can reach the device, obtaining full root access. Due to its remote nature and lack of authentication, any device exposed to the internet or local networks is at risk until mitigated."}}}}, "created": "2026-02-11T21:38:07.862324+00:00", "updated": "2026-04-17T20:30:15.807527+00:00", "vendors": ["metis_cyberspace_technology_sa", "metis_cyberspace_technology_sa$PRODUCT$metis_wic"]}