Security advisory: multiple vulnerabilities including Default-credential RCE, Pre-authentication root RCE in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)
disclosure via Fulldisclosure ·
0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec). The research is published and a proof-of-concept is available. Vulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication) The main service process atserver runs as root and exposes two independent authentication backends: a WebMI HTTP backend that verifies passwords, and an OPC UA binary protocol backend on port 4840 that does not. The OPC UA logonSessionUser path never calls the password-verification function; it only checks that the SYSTEM.SECURITY.USERS.<username> node exists. Any non-empty password for root yields a superuser session, even under a strong root password. The chain combines this auth bypass with an OPC UA write that overwrites a built-in WebMI method's V8 script, an anonymous WebMI session built via a digest bypass, and an anonymous POST that triggers the tampered V8 script. The V8 engine runs inside atserver (root), so the injected script inherits root and executes arbitrary commands. The chain was verified by reading /etc/shadow. The only precondition is that the WEBACCESS module is loaded, which is the normal running state of a licensed production deployment. Impact: Complete host compromise as root; the attacker can read any file, execute arbitrary commands, and alter SCADA control logic and node values. Advisory: https://0day-rubbish.com/blog/atvise-scada-opcua-unauth-rce Vulnerability 2: Default-credential RCE (CVSS 8.8, authenticated) The WebHMI service (Boost.Beast HTTP on ports 80/443) uses a custom WebMI authentication scheme. The built-in root user ships with a factory default empty password, and the handleLogin handler has a 'password not set' branch that grants the superuser session for an existing user without verifying the supplied passwords while that default state is in place. The chain combines the default-credential login (login(root, any value) yields the root superuser session), a V8 ScriptCode injection via AddNode, a ReportRunConfiguration trigger that loads the attacker script into the embedded V8 engine, and a ChildProcess.execAsync payload. The V8 engine runs inside atserver (root), so the injected script inherits root. Setting a strong root password via changepassword closes the login bypass. The only precondition is that the WEBACCESS module is loaded. Impact: Complete host compromise as root; the attacker can read any file, execute arbitrary commands, and alter SCADA control logic and node values. Advisory: https://0day-rubbish.com/blog/atvise-scada-webmi-auth-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/