{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "LOMOSITS.Daniel via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Reference: https://seclists.org/fulldisclosure/2026/Aug/5\n\nI tested both vulnerabilities against a clean installation of atvise SCADA 3.13.0. Results differ between the two \nfindings.\n\n---\n\nVulnerability 1 (OPC UA pre-authentication root RCE, CVSS 9.8) - NOT REPRODUCIBLE\n\nThe ActivateSession step - identified as the authentication bypass entry point - returns BadUserAccessDenied:\n\n    WebMI login(root, bogus) -\u003e 200 {\"error\":-1,\"errorstring\":\"Invalid Session or Digest\"}\n        [+] root has a strong password (bogus login rejected)\n    [Step 1] OPC UA 4840 ActivateSession(root, bogus) -- authentication bypass\n    ServiceFault (BadUserAccessDenied, diagnostics: DiagnosticInfo(\n      SymbolicId=None, NamespaceURI=None, Locale=None,\n      LocalizedText=None, AdditionalInfo=None,\n      InnerStatusCode=None, InnerDiagnosticInfo=None))\n    from server received in response to ActivateSessionRequest\n\nThe OPC UA backend rejects the bogus password and does not yield a superuser session, contrary to the advisory\u0027s claim \nthat logonSessionUser never calls the password-verification function.\n\nNote for anyone attempting independent reproduction: the advisory\u0027s license note discloses that the research was \nconducted against a binary-patched installation (patch 5: isLicensed() forced to 1; patch 6: session-count bypass). \nWhether OPC UA authentication behaviour differs between the patched binary and an unmodified licensed installation \nremains the open question. If the 0day Rubbish Research Team can clarify whether the ActivateSession step was verified \nagainst the original unpatched binary, that would help resolve the discrepancy.\n\n---\n\nVulnerability 2 (WebMI default-credential RCE, CVSS 8.8) - REPRODUCIBLE\n\nConfirmed. login(root, \u003cany value\u003e) returns {\"username\":\"root\"} on a factory-default installation. The handleLogin \n\u0027password not set\u0027 branch behaves exactly as described. Setting a strong root password via changepassword closes the \nbypass.\n\nMit freundlichen Gr\u00fc\u00dfen\nWith kind regards\n\nIng. Daniel Lomosits MSc MBA BSc\nProduct Manager\n\nP +43 (0)2682 / 75799-2829 M +43 (0) 676 / 702 80 87 | daniel.lomosits () bachmann info\u003cmailto:daniel.lomosits () \nbachmann info\u003e | www.bachmann-visutec.com\u003chttp://www.bachmann-visutec.com/\u003e\n\n[cid:image001.png@01DD2E3D.5EAA1330]\u003chttps://atvise.com/\u003e\n\nRegistered Office:\nBachmann Visutec GmbH, Kasernenstra\u00dfe 29, 7000 Eisenstadt, Austria\nFN 274018v Commercial Register Eisenstadt | ATU 62240738\nCorporate Headquarters:\nBachmann electronic GmbH, Kreuz\u00e4ckerweg 33, 6800 Feldkirch, Austria\nFN 75348g Commercial Register Feldkirch | ATU 36410905\n\nDokumente mit rechtsverbindlichem Inhalt sind nur mit Originalunterschrift wirksam.\nDocuments with legally binding subject matter are valid only with original hand-written signature.\n\nFollow Bachmann on  Facebook\u003chttps://www.facebook.com/Bachmann.electronic/\u003e |  \nLinkedIn\u003chttps://www.linkedin.com/company/bachmann-electronic-gmbh\u003e |  Twitter\u003chttps://twitter.com/bachmann_corp\u003e |  \nXing\u003chttps://www.xing.com/companies/bachmannelectronicgmbh\u003e |  \nYouTube\u003chttps://www.youtube.com/channel/UCE5LllKmEA5ZtBnsIpvVqxg\u003e\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:49:46Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/39"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/39"
        },
        {
          "url": "http://www.bachmann-visutec.com/"
        },
        {
          "url": "https://atvise.com/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/2026/Aug/5"
        },
        {
          "url": "https://twitter.com/bachmann_corp"
        },
        {
          "url": "https://www.facebook.com/Bachmann.electronic/"
        },
        {
          "url": "https://www.linkedin.com/company/bachmann-electronic-gmbh"
        },
        {
          "url": "https://www.xing.com/companies/bachmannelectronicgmbh"
        },
        {
          "url": "https://www.youtube.com/channel/UCE5LllKmEA5ZtBnsIpvVqxg"
        },
        {
          "url": "mailto:daniel.lomosits"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/39"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Security advisory: multiple vulnerabilities including Default-credential RCE, Pre-authentication root RCE in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0031",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/39",
            "automated": true,
            "contentSha256": "b464e33cfb97e6aeb144887f62b793310a01e8e379d3f8eb9852a05dd2a1e3d3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/39",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T11:42:44Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:49:46Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0031"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}