Vicon Valerus: Unauthenticated Command Injection SYSTEM RCE via OWIN Web API

Vicon Valerus 25.200.46.0 ships an OWIN self-host ASP.NET Web API with no auth middleware. POST /NVR/api/v1/upgrades/.../start concatenates a [FromBody] string directly into cmd.exe /c and calls Process.Start; the service runs as LocalSystem, so any network attacker gets default-configuration unauthenticated SYSTEM RCE.