Read the docs
TI-2026-20261 Aliases CVE-2026-25086GHSA-4p22-4q7x-9xpq

Automated Logic WebCTRL Premium Server Multiple Binds to the Same Port

Priority LOW 35CWE-605Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Under certain conditions, an attacker could bind to the same port used by WebCTRL. This could allow the attacker to craft and send malicious packets and impersonate the WebCTRL service without requiring code injection into the WebCTRL software.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00161 5th percentileScored 2026-11-07
Fix Fixed WebCTRL Premium Server (Automated Logic): v8.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Automated LogicWebCTRL Premium Serverbefore v8.5v8.5Patch availableCNA
  • WebCTRL Premium Server VendorAutomated Logic Affected before v8.5 Fixed in v8.5 Patch available CNA

Remediation

  • Fix · CNA WebCTRL Premium Server (Automated Logic) Fixed in v8.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Automated Logic WebCTRL Premium Server v8.5

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-19387 Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive InformationPriority MEDIUM 47
    • TI-2026-25167 Automated Logic WebCTRL Premium Server Authentication Bypass by SpoofingPriority LOW 39
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25086
  2. 2026-10-03 Alias added: GHSA-4p22-4q7x-9xpq

References

Other 3

  • TI-2026-19387 Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information CVSS 3.1CRITICAL 9.1
  • TI-2024-05147 ALC WebCTRL Carrier i-Vu Access Control Bypass CVSS 4.0CRITICAL 9.2
  • TI-2025-00552 Automated Logic and Carrier Zone Controllers malformed packets denial of service CVSS 4.0HIGH 8.7
  • TI-2025-00551 ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range CVSS 4.0HIGH 8.8
  • TI-2021-11749 The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a… CVSS 3.1MEDIUM 6.1
  • TI-2026-25167 Automated Logic WebCTRL Premium Server Authentication Bypass by Spoofing CVSS 3.1HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences