Re: Security advisory: multiple vulnerabilities including Default-credential RCE, Pre-authentication root RCE in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-08-18 06:14 UTC
Importiert: 2026-08-18 06:31 UTC
Quelle-ID: full_disc
uid_hash: f3d3a219de35fa6f149ce63e4f724e6bca912af666bf1b214845fe10cfb22438

Full Disclosure

Posted by LOMOSITS.Daniel via Fulldisclosure on Aug 17 Reference: https://seclists.org/fulldisclosure/2026/Aug/5

I tested both vulnerabilities against a clean installation of atvise SCADA 3.13.0. Results differ between the two

findings.

Vulnerability 1 (OPC UA pre-authentication root RCE, CVSS 9.8) - NOT REPRODUCIBLE

The ActivateSession step - identified as the authentication bypass entry point - returns BadUserAccessDenied:

WebMI login(root, bogus) -> 200...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss