METIS WIC Devices Web-Based Shell Vulnerability Allowing Root Command Execution

A vulnerability exists in METIS WIC devices running OSCORE versions through 2.1.234-r18. These devices expose a web-based shell at the '/console' endpoint, which lacks authentication. This vulnerability allows remote attackers to execute arbitrary operating system commands with root privileges, leading to a complete system compromise. Exploitation of this issue could result in unauthorized access to modify system configurations, access sensitive data, or disrupt device operations.

Impact

Exploitation of this vulnerability allows for arbitrary command execution with root privileges, resulting in full system compromise.