Carrier vulnerabilities
We track 17 vulnerabilities in Carrier products across 13 products. 17 are rated high or critical, and none are known to be exploited. The most recent was published on January 22, 2026.
Latest Carrier vulnerabilities
- 7.0 High severity
WebCTRL: Storing Passwords in a Recoverable Format
Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Format vulnerability (CWE-257) in the Web session management component allows an attacker to access store
- 8.7 High severity
A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol causes…
A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol causes the device to crash. The device enters a fault state; after a reset, a second packet can leave it permanently unresponsive until a manual power cycle is performed.
- 8.8 High severity
WebCtrl: Improper Validation of Array Index
A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to re
- 9.2 Critical severity
WebCTRL: Incorrect Authorization
The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web based building automation server.
- 8.6 High severity
WebCtrl: URL Redirection to Untrusted Site
Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions.
- 7.8 High severity
Block Load: Uncontrolled Search Path Element
An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated privileges.
- 10.0 Critical severity
WebCTRL: Unrestricted Upload of File with Dangerous Type
An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file.
- 8.8 High severity
NetBox: Improper Neutralization of Argument Delimiters in a Command
LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands.
- 9.8 Critical severity
NetBox: Improper Neutralization of Special Elements used in an OS Command
LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions.
- 9.8 Critical severity
NetBox: Use of Hard-coded Password
LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypass authentication requirements.
- 8.8 High severity
LNL-X2210: Improper Neutralization of Special Elements used in an OS Command
An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which co
- 7.5 High severity
LNL-X2210: Direct Request
An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware
- 8.8 High severity
LNL-X2210: Improper Limitation of a Pathname to a Restricted Directory
An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP
- 7.5 High severity
LNL-X2210: Buffer Copy without Checking Size of Input
An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which co
- 10.0 Critical severity
LNL-X2210: Buffer Copy without Checking Size of Input
An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware ve
- 7.5 High severity
LNL-X2210: Direct Request
An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502
- 9.8 Critical severity
LNL-X2210: Improper Neutralization of Special Elements used in an OS Command
An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1