Unauthenticated Remote Root Shell Access via Web Console in METIS WIC

The impact of CVE-2026-2248 is severe. An attacker gaining access to the /console endpoint can execute any command on the device with root privileges. This allows for complete control over the device, including the ability to modify system configurations, steal sensitive data (passwords, keys, configuration files), install malware, and disrupt device operations. The lack of authentication makes this vulnerability particularly dangerous, as any attacker with network access to the device can potentially exploit it. This is akin to having an open backdoor into the device's operating system.

Organizations deploying METIS WIC devices in industrial control systems (ICS) or critical infrastructure environments are particularly at risk. Shared hosting environments where multiple users share the same device are also vulnerable, as an attacker could potentially compromise the entire system through a single device. Legacy deployments using older, unpatched versions of oscore are also at high risk.

• linux / server:

journalctl -u metis-wic | grep /console

• generic web:

curl -I http://<device_ip>/console

Check the response headers for any signs of unauthorized access or command execution. • generic web:

curl -s http://<device_ip>/console | grep -i 'root@'  # Look for root user in output

1. 2026-02-11Disclosure

   disclosure

1. 已保留2026-02-09
2. 发布日期2026-02-11
3. 修改日期2026-02-12
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-2248 is to upgrade METIS WIC devices to oscore version 2.1.236 or later. If an immediate upgrade is not possible, consider implementing network segmentation to restrict access to the /console endpoint. Firewall rules should be configured to only allow access from trusted IP addresses. Monitoring network traffic for unusual activity targeting the /console endpoint is also recommended. While a WAF might be able to detect and block malicious requests, it is not a substitute for patching the underlying vulnerability. After upgrading, verify the vulnerability is resolved by attempting to access the /console endpoint and confirming that authentication is required.