atvise scada: opcua-unauth-rce

[dalo-bav]

I tested VULN-001 (OPC UA authentication bypass) against a clean installation of atvise SCADA 3.13.0 and was not able to reproduce it.

The ActivateSession step fails with BadUserAccessDenied:

WebMI login(root, bogus) -> 200 {"error":-1,"errorstring":"Invalid Session or Digest"}
[+] root has a strong password (bogus login rejected)
[Step 1] OPC UA 4840 ActivateSession(root, bogus)
ServiceFault (BadUserAccessDenied, diagnostics: DiagnosticInfo(
SymbolicId=None, NamespaceURI=None, Locale=None,
LocalizedText=None, AdditionalInfo=None,
InnerStatusCode=None, InnerDiagnosticInfo=None))
from server received in response to ActivateSessionRequest

A few questions that might explain the discrepancy:

• Was the OPC UA step tested against the patched binary or the original unpatched binary? Your license note states the patches don't touch logonSessionUser — but this is the one thing I cannot verify from the outside.
• Which asyncua version and which exact ActivateSession parameters were used? I want to rule out a client-side fallback to anonymous mode.
• Would you be willing to share the PoC script privately so this can be tested against an unmodified licensed installation?