CVE-2026-2248 exploits a flaw in METIS WIC devices that exposes a web‑based shell at the /console endpoint without requiring authentication. This allows an attacker who can reach the device over the network to run arbitrary operating system commands with root (UID 0) privileges, resulting in complete control over the device, including configuration changes, data exfiltration, and service disruption. The weakness is an authentication bypass (CWE‑287) and missing authentication controls (CWE‑306).

Affected devices are METIS WIC units manufactured by METIS Cyberspace Technology SA. Versions up to and including oscore 2.1.234‑r18 are impacted. Users running these firmware releases should confirm compatibility and plan for an upgrade.

The CVSS base score is 9.8, indicating critical severity. The EPSS score of less than 1 % indicates that, at the time of analysis, the exploitation likelihood is low but not zero. The vulnerability is not listed in the CISA KEV catalog. An unauthenticated remote attacker can exploit it by sending an HTTP request to the /console endpoint from any network segment that can reach the device, obtaining full root access. Due to its remote nature and lack of authentication, any device exposed to the internet or local networks is at risk until mitigated.