AdRem NetCrunch: Authenticated SYSTEM RCE via Startup Script Command Execution

The INcStartupScript.SetScriptOptions RPC interface persists an arbitrary executable path and arguments to the registry with no command allowlist; RestartNCServer then triggers execution on service restart. Any authenticated user achieves SYSTEM-privilege arbitrary command execution.