Automated Logic vulnerabilities
Published CVEs affecting Automated Logic products: 10 record(s), with severity, exploitation and fixes.
CVE-2026-32666
High · 7.5
CWE-290 Mar 20, 2026
Automated Logic WebCTRL Premium Server Authentication Bypass by Spoofing
WebCTRL systems that communicate over BACnet inherit the protocol's lack
of network layer authentication. WebCTRL does not implement additional
validation of BACnet traffic so an attacker with network access could
spoof BACnet packets directed at either the WebCTRL server or associated
AutomatedLogic controllers. Spoofed packets may be processed as
legitimate.
CVE-2026-25086
High · 7.7
CWE-605 Mar 20, 2026
Automated Logic WebCTRL Premium Server Multiple Binds to the Same Port
Under certain conditions, an attacker could bind to the same port used
by WebCTRL. This could allow the attacker to craft and send malicious
packets and impersonate the WebCTRL service without requiring code
injection into the WebCTRL software.
CVE-2026-24060
Critical · 9.1
CWE-319 Mar 20, 2026
Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information
Service information is not encrypted when transmitted as BACnet packets
over the wire, and can be sniffed, intercepted, and modified by an
attacker. Valuable information such as the File Start Position and File
Data can be sniffed from network traffic using Wireshark's BACnet
dissector filter. The proprietary format used by WebCTRL to receive
updates from the PLC can also be sniffed and reverse engineered.
CVE-2025-14295
High · 7.0
CWE-257 Jan 22, 2026
Automated Logic WebCTRL and Carrier i-Vu Session Fixation
Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Format vulnerability (CWE-257) in the Web session management component allows an attacker to access stored passwords in a recoverable format which makes them subject to password reuse attacks by malicious users.This issue affects WebCTRL: from 6.0 through 9.0; i-Vu: from 6.0 through 9.0.
CVE-2025-0658
High · 8.7
CWE-20 Nov 26, 2025
Automated Logic and Carrier Zone Controllers malformed packets denial of service
A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol
causes the device to crash. The device enters a fault state; after a reset,
a second packet can leave it permanently unresponsive until a manual power cycle
is performed.
CVE-2025-0657
High · 8.8
CWE-129 Nov 26, 2025
ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range
A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver
version drv_gen5_106-01-2380, allows
malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to
return the device to network visibility.
CVE-2024-5540
Medium · 6.9
CWE-79 Nov 26, 2025
ALC WebCTRL Carrier i-Vu Reflected Cross-Site Scripting
The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allowing a
malicious actor to compromise the client browser
.
CVE-2024-5539
Critical · 9.2
CWE-863 Nov 26, 2025
ALC WebCTRL Carrier i-Vu Access Control Bypass
The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the
web based building automation server.
CVE-2024-8528
Medium · 5.4
CWE-79 Nov 19, 2025
ALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameter
Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized.
CVE-2024-8527
High · 8.6
CWE-601 Nov 19, 2025
ALC WebCTRL Carrier i-Vu Open Redirect via URL parameter
Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions.