WebCTRL vulnerabilities

4 known vulnerabilities in WebCTRL from Automated Logic. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.0 High severity

  WebCTRL: Storing Passwords in a Recoverable Format

  CVE-2025-14295Jan 22, 2026Automated Logic

  Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Format vulnerability (CWE-257) in the Web session management component allows an attacker to access store

• 8.8 High severity

  WebCtrl: Improper Validation of Array Index

  CVE-2025-0657Nov 27, 2025Automated Logic

  A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to re

• 9.2 Critical severity

  WebCTRL: Incorrect Authorization

  CVE-2024-5539Nov 27, 2025Automated Logic

  The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web based building automation server.

• 8.6 High severity

  WebCtrl: URL Redirection to Untrusted Site

  CVE-2024-8527Nov 19, 2025Automated Logic

  Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions.