Posted by disclosure via Fulldisclosure on Aug 170day Rubbish Research Team is publicly disclosing a vulnerability in MAPS SCADA 4.0.5.5 (Adroit Technologies). The research is published and a proof-of-concept is available. Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication) MAPS SCADA 4.0.5.5 exposes an IIS WebService (default port 8878) whose WSDataProvider.asmx endpoints deserialize the caller-supplied byte array before any authentication. Serializer.BinaryDeserialization...