Two unauthenticated industrial flaws scored 9.8 disclosed

0day Rubbish disclosed unauthenticated flaws in Advantech WebAccess Node 9.2.3 and Circutor LineEds 24.11.14-r0, both scored 9.8, with no CVEs or known exploitation.

On 6 October 2026 the 0day Rubbish Research Team published two separate unauthenticated vulnerability disclosures, each scored 9.8, and neither assigned a CVE or linked to observed exploitation. In Advantech WebAccess Node 9.2.3, a closed-source industrial SCADA/HMI web server from Advantech in Taiwan, CrystalRpt.aspx permits unrestricted file upload combined with path traversal and performs no authorization check, enabling code execution in w3wp.exe; it maps to CWE-434, CWE-22, and CWE-306, with higher impact if the IIS pool runs with elevated privileges. Separately, Circutor LineEds firmware 24.11.14-r0, engine variant pss0, contains an operating-system command injection classified as CWE-78 in the pwrstudio daemon, reached through an events.xml shellExecute path. Circutor S.A., based in Spain, positions that gateway between metering and power-quality devices and an energy-management or SCADA back office. The two Full Disclosure posts, timestamped two seconds apart, do not contradict each other because they describe different products.