Re: Security advisory: multiple vulnerabilities including Default-credential RCE, Pre-authentication root RCE in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)

["LOMOSITS.Daniel via Fulldisclosure" <fulldisclosure () seclists org>]

Reference: https://seclists.org/fulldisclosure/2026/Aug/5

I tested both vulnerabilities against a clean installation of atvise SCADA 3.13.0. Results differ between the two 
findings.

---

Vulnerability 1 (OPC UA pre-authentication root RCE, CVSS 9.8) - NOT REPRODUCIBLE

The ActivateSession step - identified as the authentication bypass entry point - returns BadUserAccessDenied:

    WebMI login(root, bogus) -> 200 {"error":-1,"errorstring":"Invalid Session or Digest"}
        [+] root has a strong password (bogus login rejected)
    [Step 1] OPC UA 4840 ActivateSession(root, bogus) -- authentication bypass
    ServiceFault (BadUserAccessDenied, diagnostics: DiagnosticInfo(
      SymbolicId=None, NamespaceURI=None, Locale=None,
      LocalizedText=None, AdditionalInfo=None,
      InnerStatusCode=None, InnerDiagnosticInfo=None))
    from server received in response to ActivateSessionRequest

The OPC UA backend rejects the bogus password and does not yield a superuser session, contrary to the advisory's claim 
that logonSessionUser never calls the password-verification function.

Note for anyone attempting independent reproduction: the advisory's license note discloses that the research was 
conducted against a binary-patched installation (patch 5: isLicensed() forced to 1; patch 6: session-count bypass). 
Whether OPC UA authentication behaviour differs between the patched binary and an unmodified licensed installation 
remains the open question. If the 0day Rubbish Research Team can clarify whether the ActivateSession step was verified 
against the original unpatched binary, that would help resolve the discrepancy.

---

Vulnerability 2 (WebMI default-credential RCE, CVSS 8.8) - REPRODUCIBLE

Confirmed. login(root, <any value>) returns {"username":"root"} on a factory-default installation. The handleLogin 
'password not set' branch behaves exactly as described. Setting a strong root password via changepassword closes the 
bypass.

Mit freundlichen Grüßen
With kind regards

Ing. Daniel Lomosits MSc MBA BSc
Product Manager

P +43 (0)2682 / 75799-2829 M +43 (0) 676 / 702 80 87 | daniel.lomosits () bachmann info<mailto:daniel.lomosits () 
bachmann info> | www.bachmann-visutec.com<http://www.bachmann-visutec.com/>

[cid:image001.png@01DD2E3D.5EAA1330]<https://atvise.com/>

Registered Office:
Bachmann Visutec GmbH, Kasernenstraße 29, 7000 Eisenstadt, Austria
FN 274018v Commercial Register Eisenstadt | ATU 62240738
Corporate Headquarters:
Bachmann electronic GmbH, Kreuzäckerweg 33, 6800 Feldkirch, Austria
FN 75348g Commercial Register Feldkirch | ATU 36410905

Dokumente mit rechtsverbindlichem Inhalt sind nur mit Originalunterschrift wirksam.
Documents with legally binding subject matter are valid only with original hand-written signature.

Follow Bachmann on  Facebook<https://www.facebook.com/Bachmann.electronic/> |  
LinkedIn<https://www.linkedin.com/company/bachmann-electronic-gmbh> |  Twitter<https://twitter.com/bachmann_corp> |  
Xing<https://www.xing.com/companies/bachmannelectronicgmbh> |  
YouTube<https://www.youtube.com/channel/UCE5LllKmEA5ZtBnsIpvVqxg>

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/