Security advisory: multiple vulnerabilities including Default-credential RCE, Pre-authentication root RCE in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)

<p>Posted by disclosure via Fulldisclosure on Aug 06</p>0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in atvise SCADA 3.13.0 (atvise GmbH / Bachmann <br /> Visutec). The research is published and a proof-of-concept is available.<br /> <br /> Vulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)<br /> <br /> The main service process atserver runs as root