Critical JWT Forgery and Pre-Auth SYSTEM RCE Disclosed in CIRCUTOR PowerStudio

Public advisories disclosed multiple critical vulnerabilities in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0, including a JWT forgery flaw that enables authentication bypass across .NET Core microservices. The issue stems from fail-open JWT validation, allowing attackers to submit forged alg=none tokens with arbitrary role claims and gain authenticated access without valid credentials. Researchers said the weakness affects every microservice that trusts the shared identity model, creating broad exposure across the platform.

The same research also detailed a pre-authentication remote code execution chain that can lead to command execution as NT AUTHORITY\SYSTEM. The chain combines the JWT bypass with a path-traversal write to a malicious events configuration and an engine restart to trigger attacker-controlled commands. The advisory said the RCE path requires reachability to PSSAdministrator on port 8089; if that service is restricted to loopback with no forwarding path, a fully remote unauthenticated attacker cannot complete exploitation. Proof-of-concept code and full technical analysis were released publicly by the 0day Rubbish Research Team.