atvise SCADA: Unauthenticated Root RCE via OPC UA Auth Bypass and V8 Script Injection

atvise SCADA 3.13.0 runs atserver as root and exposes an OPC UA binary backend on port 4840 that never verifies passwords. Any non-empty password for the built-in root user yields a superuser session; the chain writes a malicious V8 script via OPC UA and triggers it through an anonymous WebMI session for root command execution.