productsecurity@carrier.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS productsecurity@carrier.com
03
assessed vulnerabilities (24)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-14295US | — | — | ||
Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Format vulnerability (CWE… | ||||
| CVE-2025-0658US | — | — | ||
A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol
causes the device to crash. The device enters a fault state; after a reset,
a second packet can… | ||||
| CVE-2025-0657US | — | — | ||
A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver
version drv_gen5_106-01-2380, allows
malformed packets to be sent through BACnet MS/TP network causing the… | ||||
| CVE-2024-5540US | — | — | ||
The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allowing a
malicious actor to compromise t… | ||||
| CVE-2024-5539US | —OT elevated | — | ||
The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions an… | ||||
| CVE-2024-8528US | — | — | ||
Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized. | ||||
| CVE-2024-8527US | — | — | ||
Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions. | ||||
| CVE-2025-9495US | — | — | ||
The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTM… | ||||
| CVE-2025-9494US | — | — | ||
An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/c… | ||||
| CVE-2024-10930US | high7.8 | Exploit | ||
An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated privileges. | ||||
| CVE-2024-8526US | — | — | ||
A vulnerability in Automated Logic WebCTRL 7.0 could allow an attacker to send a maliciously
crafted URL, which when visited by an authenticated WebCTRL user, could result in the r… | ||||
| CVE-2024-8525US | — | — | ||
An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST re… | ||||
| CVE-2024-2422US | high8.8 | — | ||
LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execu… | ||||
| CVE-2024-2421US | critical9.8 | — | ||
LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to exe… | ||||
| CVE-2024-2420US | critical9.8OT elevated | — | ||
LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypas… | ||||
| CVE-2023-36483US | — | — | ||
Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and
MASmobile Classic iOS version 1.7.24 and earlier
whic… | ||||
| CVE-2022-31486US | high8.8 | — | ||
An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mer… | ||||
| CVE-2022-31485US | medium5.3 | — | ||
An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impacts products based on H… | ||||
| CVE-2022-31484US | high7.5 | — | ||
An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligen… | ||||
| CVE-2022-31483US | high8.8 | — | ||
An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability… | ||||