ExploitGarbage

Came across a disclosure in Altus BluePlant 9.1.40 — a SCADA HMI / ICS platform. CVSS 9.8, unauthenticated RCE, default configuration, as the service account (administrator). The standout: the vendor's auth validator hardcodes three credential-bypass paths in code. Use any one to bypass Connect, get a connectionHandle, then drive a generic RMI gateway to FileServer.RunProcess → Process.Start. No creds, no TLS, port 3100 reachable by default after install. Full root-cause + self-contained PoC on the advisory page. https://0day-rubbish.com/blog/altus-blueplant-hardcoded-creds-rce https://github.com/Exploit-Garbage/0day-Rubbish The project attributes discovery to an automated multi-LLM process (Claude/OpenAI/DeepSeek/GLM), defensive framing, full-disclosure posture. Not affiliated; noting for awareness. #infosec #ICS #SCADA #OTsecurity #vulnerability #0day #RCE #exploit

Unauthenticated RCE in InterSystems IRIS 2026.1 — CVSS 9.8, runs as the irisowner account, no credentials beyond the built-in CSPSystem default. The technically novel part: the code executes at *compile* time, not call time. Chain: CSP broker (unauth, CSPSystem/SYS default) exposes %DeepSee.UI.FolderManager.ImportItems as a reachable ZenMethod. directory and selectedFiles are plaintext S-type Zen properties, so they're injected straight through the broker pBody — no encryption, fully attacker-controlled. ImportItems calls $system.OBJ.Load(file, "c"). The "c" flag *compiles* the loaded IRIS XML export. The export carries a ClassMethod with CodeMode=objectgenerator — its implementation body runs DURING compilation, and calls $ZF(-100,"","/bin/sh","-c",cmd) as irisowner. Output is redirected to a webroot static file and pulled back via an anonymous GET. So it's a real RCE with output retrieval, not a blind write. Defender-relevant: this sidesteps InterSystems' AutoCompile=false mitigation (DP-441283, added in 2025.1.1+/2025.2.0+). That mitigation blocks CSP *auto*-compilation; it does not block an explicit OBJ.Load("c") call from a reachable ZenMethod. ImportItems calls OBJ.Load("c") directly, so the mitigation doesn't apply. The fix that actually breaks the chain: separate the ReceiveFragment write directory from the OBJ.Load load directory. They currently overlap in /usr/irissys/mgr/Temp/ — that overlap is what closes the write -> load -> compile -> exec loop. The writeup claims the chain was found by method-by-method auditing the 4312 ZenMethods reachable by CSPSystem and picking the highest-value one. Full root-cause analysis + a self-contained PoC on the advisory page. https://0day-rubbish.com/blog/intersystems-iris-foldermanager-rce https://github.com/Exploit-Garbage/0day-Rubbish

🚨 New 0-day: SonicWall SMA 1000 pre-auth RCE chain (CVSS 9.8). No creds, no appliance knowledge — just an address. 1️⃣ Struts 1 multipartRequestHandler property injection rewrites Jetty auth filter mappings → /Console + console unauthenticated 2️⃣ Enable CMS → unauth SSO Primary Admin token → JSESSIONID 3️⃣ Java deser via setStoredCommunity (BeanComparator+TemplatesImpl) → RCE as mgmt-server (uid=1011) Output → webroot → anonymous GET. Full analysis + PoC: https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce #0day #RCE #Infosec