CIRCUTOR PowerStudio SCADA WAVE: Unauthenticated shellExecute SYSTEM RCE

CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 runs PwrStudio.exe as SYSTEM. A fail-open JWT library accepts forged alg=none tokens across every microservice. Chaining a path-traversal config write (8105) with an HTTP engine restart (8089) fires shellExecute as SYSTEM. Requires reaching both microservices; 8089 defaults to loopback.