Altus BluePlant: Unauthenticated RCE via Hardcoded Credentials and Reflective Method Dispatch

Altus BluePlant 9.1.40 hosts a WCF service with security=None whose Connect method hardcodes three credential-bypass paths. A forged pass yields a connectionHandle; SendRequest reflectively dispatches FileServer.RunProcess -> Process.Start for default-configuration unauthenticated RCE as administrator.