Vulnerabilities

TI-2026-19387 CVE-2026-24060 · GHSA-79hg-m6px-6m7h

Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information

MEDIUM 47

Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00208 Published 2026-03-20 Fixed in v8.5 CWE-319

TI-2026-25167 CVE-2026-32666 · GHSA-2v87-3m5p-q6cw

LOW 39

WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00348 Published 2026-03-20 Fixed in v8.5 CWE-290

TI-2026-20261 CVE-2026-25086 · GHSA-4p22-4q7x-9xpq

LOW 35

Under certain conditions, an attacker could bind to the same port used by WebCTRL.

CVSS 3.1HIGH 7.7 Local No auth No interaction EPSS 0.00161 Published 2026-03-20 Fixed in v8.5 CWE-605