Came across a disclosure in Altus BluePlant 9.1.40 — a SCADA HMI / ICS platform. CVSS 9.8, unauthenticated RCE, default configuration, as the service account (administrator). The standout: the vendor's auth validator hardcodes three credential-bypass paths in code. Use any one to bypass Connect, get a connectionHandle, then drive a generic RMI gateway to FileServer.RunProcess → Process.Start. No creds, no TLS, port 3100 reachable by default after install. Full root-cause + self-contained PoC on the advisory page. https://0day-rubbish.com/blog/altus-blueplant-hardcoded-creds-rce https://github.com/Exploit-Garbage/0day-Rubbish The project attributes discovery to an automated multi-LLM process (Claude/OpenAI/DeepSeek/GLM), defensive framing, full-disclosure posture. Not affiliated; noting for awareness. #infosec #ICS #SCADA #OTsecurity #vulnerability #0day #RCE #exploit