{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in atvise SCADA 3.13.0 (atvise GmbH / Bachmann \nVisutec). The research is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nThe main service process atserver runs as root and exposes two independent authentication backends: a WebMI HTTP \nbackend that verifies passwords, and an OPC UA binary protocol backend on port 4840 that does not. The OPC UA \nlogonSessionUser path never calls the password-verification function; it only checks that the \nSYSTEM.SECURITY.USERS.\u003cusername\u003e node exists. Any non-empty password for root yields a superuser session, even under a \nstrong root password. The chain combines this auth bypass with an OPC UA write that overwrites a built-in WebMI \nmethod\u0027s V8 script, an anonymous WebMI session built via a digest bypass, and an anonymous POST that triggers the \ntampered V8 script. The V8 engine runs inside atserver (root), so the injected script inherits root and executes \narbitrary commands. The chain was verified by reading /etc/shadow. The only precondition is that the WEBACCESS module \nis loaded, which is the normal running state of a licensed production deployment.\n\nImpact: Complete host compromise as root; the attacker can read any file, execute arbitrary commands, and alter SCADA \ncontrol logic and node values.\n\nAdvisory: https://0day-rubbish.com/blog/atvise-scada-opcua-unauth-rce\n\nVulnerability 2: Default-credential RCE (CVSS 8.8, authenticated)\n\nThe WebHMI service (Boost.Beast HTTP on ports 80/443) uses a custom WebMI authentication scheme. The built-in root user \nships with a factory default empty password, and the handleLogin handler has a \u0027password not set\u0027 branch that grants \nthe superuser session for an existing user without verifying the supplied passwords while that default state is in \nplace. The chain combines the default-credential login (login(root, any value) yields the root superuser session), a V8 \nScriptCode injection via AddNode, a ReportRunConfiguration trigger that loads the attacker script into the embedded V8 \nengine, and a ChildProcess.execAsync payload. The V8 engine runs inside atserver (root), so the injected script \ninherits root. Setting a strong root password via changepassword closes the login bypass. The only precondition is that \nthe WEBACCESS module is loaded.\n\nImpact: Complete host compromise as root; the attacker can read any file, execute arbitrary commands, and alter SCADA \ncontrol logic and node values.\n\nAdvisory: https://0day-rubbish.com/blog/atvise-scada-webmi-auth-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/5"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/atvise-scada-opcua-unauth-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/atvise-scada-webmi-auth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including Default-credential RCE, Pre-authentication root RCE in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0053",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/5",
            "automated": true,
            "contentSha256": "5f35e4b7a988f79d9ca7b4948960b18fa7e165d1082fce2c8b33313be9737c3c",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:35:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0053"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}