atvise SCADA WebMI: Default-Credential Authenticated Root RCE via V8 Script Injection

atvise SCADA 3.13.0's built-in root user ships with a factory-default empty password; the WebMI handleLogin handler grants the superuser session without verifying the supplied password while that default state holds. An authenticated attacker writes a V8 ScriptCode node via AddNode and triggers it via ReportRunConfiguration — the V8 engine runs inside the root atserver process, yielding root command execution through ChildProcess.execAsync. Setting a strong root password closes the login bypass.