Read the docs
TI-2026-19387 Aliases CVE-2026-24060GHSA-79hg-m6px-6m7h

Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information

Priority MEDIUM 47CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. The proprietary format used by WebCTRL to receive updates from the PLC can also be sniffed and reverse engineered.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00208 10th percentileScored 2026-11-07
Fix Fixed WebCTRL Premium Server (Automated Logic): v8.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Automated LogicWebCTRL Premium Serverbefore v8.5v8.5Patch availableCNA
  • WebCTRL Premium Server VendorAutomated Logic Affected before v8.5 Fixed in v8.5 Patch available CNA

Remediation

  • Fix · CNA WebCTRL Premium Server (Automated Logic) Fixed in v8.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Automated Logic WebCTRL Premium Server v8.5

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-25167 Automated Logic WebCTRL Premium Server Authentication Bypass by SpoofingPriority LOW 39
    • TI-2026-20261 Automated Logic WebCTRL Premium Server Multiple Binds to the Same PortPriority LOW 35
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24060
  2. 2026-10-03 Alias added: GHSA-79hg-m6px-6m7h

References

Other 3

  • TI-2024-05147 ALC WebCTRL Carrier i-Vu Access Control Bypass CVSS 4.0CRITICAL 9.2
  • TI-2025-00552 Automated Logic and Carrier Zone Controllers malformed packets denial of service CVSS 4.0HIGH 8.7
  • TI-2025-00551 ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range CVSS 4.0HIGH 8.8
  • TI-2021-11749 The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a… CVSS 3.1MEDIUM 6.1
  • TI-2026-25167 Automated Logic WebCTRL Premium Server Authentication Bypass by Spoofing CVSS 3.1HIGH 7.5
  • TI-2017-07049 Unrestricted file upload in Automated Logic Corporation WebCTRL, i-VU, SiteScan CVSS 3.0HIGH 7.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences