Security advisory: multiple vulnerabilities including JWT forgery / authentication bypass, Pre-authentication SYSTEM RCE in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 (CIRCUTOR S.A.)

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2026-08-06 19:23 UTC
  • Importiert: 2026-08-06 20:11 UTC
  • Quelle-ID: full_disc
  • uid_hash: b5fc0e41aae38eab1669b577b0c57841f4f711fe6b61a1840c5924675f7824c0
Full Disclosure

Inhalt

Posted by disclosure via Fulldisclosure on Aug 06 0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0

(CIRCUTOR S.A.). The research is published and a proof-of-concept is available.

Vulnerability 1: Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)

The native engine PwrStudio.exe runs as the Windows service CircutorPowerStudioScadaServer under NT AUTHORITY\SYSTEM.

The shared fail-open JWT library (see companion advisory)...

No data

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
Full Disclosure

full_disc

 threat_intel - de https://seclists.org/rss/fulldisclosure.rss
Zurueck zur Eintrags-Liste