Loading story…
Public advisories disclosed two root-level remote code execution vulnerabilities in atvise SCADA 3.13.0 from atvise GmbH / Bachmann Visutec, affecting deployments with the WEBACCESS module enabled. One flaw allows pre-authentication compromise through an OPC UA authentication bypass on port 4840, which can be chained with WebMI script tampering and anonymous request paths to execute arbitrary commands as root. The second issue is an authenticated default-credential RCE in WebHMI/WebMI, where a built-in root account ships with an empty password and a login branch can grant a superuser session without proper password verification while that default state remains.
Researchers said successful exploitation can lead to complete host compromise, including arbitrary command execution, file access, and manipulation of SCADA control logic and node values. The advisory noted that WEBACCESS is normally loaded in licensed production deployments, increasing practical exposure, and said proof-of-concept code and full technical analysis were released publicly through Full Disclosure and separate write-ups covering the OPC UA unauthenticated attack path and the WebMI default-credential RCE.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On 0day Rubbish's site, the researchers published advisories covering two atvise SCADA 3.13.0 remote code execution issues: an unauthenticated OPC UA auth-bypass-to-root RCE and a default-credential authenticated root RCE. The publication included technical analysis and proof-of-concept material.
The two atvise SCADA 3.13.0 vulnerabilities were publicly disclosed through the Full Disclosure mailing list archives. The posting described complete root compromise impact and noted that proof-of-concept code and full analysis were publicly available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open source0day-rubbish.com
Open source0day-rubbish.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AVEVA disclosed a critical deserialization of untrusted data vulnerability in **Enterprise SCADA** tracked as `CVE-2025-7639`, a remotely exploitable flaw with a **CVSS 4.0 score of 10.0**. The issue allows an authenticated attacker holding the **"DNA Authority - Operator"** privilege to tamper with serialized data and potentially trigger code execution during deserialization under the privileges of the **"DNA Apps"** security group. The vendor addressed the issue in security bulletin **`AVEVA-2026-005`** and advised organizations to apply available patches and hardening measures. Recommended mitigations include restricting operator privileges and validating serialized data inputs, as the flaw affects industrial control and supervisory environments where compromise of SCADA application privileges could materially increase operational risk.
Aug 14, 2026
Advantech WebAccess/SCADA has been found to contain several critical vulnerabilities, including an unrestricted file upload flaw (CVE-2025-14849) and a directory traversal vulnerability (CVE-2025-14850). The unrestricted file upload issue could allow a remote attacker to execute arbitrary code on affected systems, while the directory traversal flaw may enable attackers to delete arbitrary files. Both vulnerabilities are remotely exploitable and have been assigned high CVSS scores, indicating significant risk to organizations using this software in critical infrastructure sectors. CISA has issued an advisory confirming that these vulnerabilities affect Advantech WebAccess/SCADA version 9.2.1, and recommends updating to version 9.2.2 to mitigate the risks. The vulnerabilities impact organizations in sectors such as critical manufacturing, energy, and water and wastewater, with deployments worldwide. Exploitation of these flaws could allow authenticated attackers to read or modify remote databases, potentially leading to severe operational disruptions.
Jun 29, 2026
Advantech released security updates for **EKI-series industrial wireless access points** after researchers disclosed **20 vulnerabilities**, including **six critical flaws** tracked as `CVE-2024-50370` through `CVE-2024-50375`. The most severe issues affect over-the-air functionality and can let a **remote, unauthenticated attacker** bypass authentication, execute arbitrary code as **root**, and take full control of exposed devices. The affected products are **EKI-6333AC-2G** and **EKI-6333AC-2GD** running firmware earlier than **v1.6.5**, and **EKI-6333AC-1GPO** running firmware earlier than **v1.2.2**. Additional high-severity weaknesses could enable **cross-site scripting**, **system command injection**, **denial of service**, and unauthorized access to sensitive data. Defenders are advised to **immediately upgrade firmware** to the vendor-fixed versions and review internet-exposed or operational technology deployments using these access points.
Jul 24, 2026