The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and read arbitrary files via unspecified vectors.
https://ics-cert.us-cert.gov/advisories/ICSA-16-159-01
https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-5497