Came across a disclosure in Altus BluePlant 9.1.40 — a SCADA HMI / ICS platform. CVSS 9.8, unauthenticated RCE, default configuration, as the service account (administrator).
The standout: the vendor's auth validator hardcodes three credential-bypass paths in code. Use any one to bypass Connect, get a connectionHandle, then drive a generic RMI gateway to FileServer.RunProcess → Process.Start. No creds, no TLS, port 3100 reachable by default after install.
Full root-cause + self-contained PoC on the advisory page.
https://0day-rubbish.com/blog/altus-blueplant-hardcoded-creds-rce
https://github.com/Exploit-Garbage/0day-Rubbish
The project attributes discovery to an automated multi-LLM process (Claude/OpenAI/DeepSeek/GLM), defensive framing, full-disclosure posture. Not affiliated; noting for awareness.
#infosec #ICS #SCADA #OTsecurity #vulnerability #0day #RCE #exploit