ICSA-26-078-08

icsaUScisa_csaf_ot

Automated Logic WebCTRL Premium Server

view advisory published 2026-03-19

Successful exploitation of these vulnerabilities could allow an attacker to read, intercept, or modify communications.

01

describes (3)

Related CVEs.

IDseverity exploitable
CVE-2026-32666US——
WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additional validation of BACnet traffic so an…
CVE-2026-25086US——
Under certain conditions, an attacker could bind to the same port used by WebCTRL. This could allow the attacker to craft and send malicious packets and impersonate the WebCTRL s…
CVE-2026-24060US—OT elevated—
Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as…
02

references

External citations — patches, advisories, analysis.

03

remediations (3)

  • MitigationWebCTRL Premium Server

    Automated Logic notes that WebCTRL 7 is End of Life (EOL) and has been out of support since January 27, 2023. Users are advised to upgrade to the latest version of the WebCTRL server application, which supports the more secure BACnet/SC.

  • MitigationWebCTRL Premium Server

    Automated Logic notes that WebCTRL 7 is End of Life (EOL) and has been out of support since January 27, 2023. Users are advised to upgrade to the latest version of the WebCTRL server application, which supports the more secure BACnet/SC.

  • MitigationWebCTRL Premium Server

    Automated Logic notes that WebCTRL 7 is End of Life (EOL) and has been out of support since January 27, 2023. Users are advised to upgrade to the latest version of the WebCTRL server application, which supports the more secure BACnet/SC.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan