VulnHub

Real-time Cybersecurity News

Critical

Automated Logic WebCTRL Premium Server

All CISA Advisories
PhishingCVEExploitVulnerabilityUpdateCritical

Overview

The Automated Logic WebCTRL Premium Server has critical vulnerabilities, including an Open Redirect and Cross-site Scripting, with a CVSS v4 score of 8.6. Successful exploitation could allow remote attackers to redirect users to malicious sites or execute malicious scripts in their browsers, posing significant security risks.

Key Takeaways

  • Affected Systems: Affected products include: Automated Logic WebCTRL Server (Versions 6.1, 7.0, 8.0, 8.5), Carrier i-Vu (Versions 6.1, 7.0, 8.0, 8.5), Automated Logic SiteScan Web (Versions 6.1, 7.0, 8.0, 8.5), and Automated Logic WebCTRL for OEMs (Versions 6.1, 7.0, 8.0, 8.5). Vendor: Automated Logic.
  • Action Required: Users are advised to upgrade to WebCTRL version 9.
  • Timeline: Disclosed on November 20, 2025

Original Article Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.6 ATTENTION: Low attack complexity Vendor: Automated Logic Equipment: WebCTRL Premium Server Vulnerabilities: Open Redirect, Cross-site Scripting 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow a remote attacker to deceive a legitimate user into running malicious scripts or redirecting them to malicious websites. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Automated Logic products are affected: Automated Logic WebCTRL Server: Version 6.1 Automated Logic WebCTRL Server: Version 7.0 Automated Logic WebCTRL Server: Version 8.0 Automated Logic WebCTRL Server: Version 8.5 Carrier i-Vu: Version 6.1 Carrier i-Vu: Version 7.0 Carrier i-Vu: Version 8.0 Carrier i-Vu: Version 8.5 Automated Logic SiteScan Web: Version 6.1 Automated Logic SiteScan Web: Version 7.0 Automated Logic SiteScan Web: Version 8.0 Automated Logic SiteScan Web: Version 8.5 Automated Logic WebCTRL for OEMs: Version 6.1 Automated Logic WebCTRL for OEMs: Version 7.0 Automated Logic WebCTRL for OEMs: Version 8.0 Automated Logic WebCTRL for OEMs: Version 8.5 3.2 Vulnerability Overview 3.2.1 URL Redirection to Untrusted Site ('Open Redirect') CWE-601 This weakness occurs when an application accepts a user-supplied URL and redirects the user to that URL without proper validation. Attackers can exploit this to redirect victims to malicious sites, often used in phishing or to bypass security controls. CVE-2024-8527 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). A CVSS v4 score has also been calculated for CVE-2024-8527. A base score of 8.6 has been calculated; the CVSS vector string is (CVSS4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L). 3.2.2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 Automated Logic WebCTRL could allow an attacker to send a malicious script to an unsuspecting user due to the "wbs" GET parameter not being sanitized. The application includes untrusted data in a web page without proper validation or escaping, allowing attackers to execute malicious scripts in the user's browser. CVE-2024-8528 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H). A CVSS v4 score has also been calculated for CVE-2024-8528. A base score of 5.4 has been calculated; the CVSS vector string is (CVSS4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: United States 3.4 RESEARCHER Jaryl Low, Thuy D. Nguyen, and Cynthia E. Irvine reported these vulnerabilities to CISA. 4. MITIGATIONS Automated Logic has reported the following: Users are advised to upgrade to the latest available version. These vulnerabilities have been remediated in Web CTRL 9.0. Web CTRL 7.0, Web CTRL 6.1, i-Vu 6.0 are out of support. Additionally, Users are encouraged to follow Automated Logic's [Security Best Practices Checklists for Building Automation Systems (BAS)](https://www.automatedlogic.com/en/media/Security Best Practices for a WebCTRL v8.0 system-522_tcm702-168128.pdf) to ensure alignment with best practices installation guidelines. For more information, visit Carrier's security advisories: https://www.corporate.carrier.com/product-security/advisories-resources/ CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. This vulnerability is not exploitable remotely. 5. UPDATE HISTORY November 20, 2025: Initial Publication

Impact

Affected products include: Automated Logic WebCTRL Server (Versions 6.1, 7.0, 8.0, 8.5), Carrier i-Vu (Versions 6.1, 7.0, 8.0, 8.5), Automated Logic SiteScan Web (Versions 6.1, 7.0, 8.0, 8.5), and Automated Logic WebCTRL for OEMs (Versions 6.1, 7.0, 8.0, 8.5). Vendor: Automated Logic.

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Disclosed on November 20, 2025

Remediation

Users are advised to upgrade to WebCTRL version 9.0, as vulnerabilities have been remediated in this version. WebCTRL 7.0, WebCTRL 6.1, and i-Vu 6.0 are out of support. Users should follow Automated Logic's Security Best Practices Checklists for Building Automation Systems (BAS) to align with best practices installation guidelines. CISA recommends minimizing network exposure for control system devices, using firewalls, and employing secure remote access methods like VPNs.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Phishing, CVE, Exploit, and 3 more.

Read Original Article

Related Coverage

CISOs Feel the Heat Over AI Risk

darkreading

As companies increasingly adopt artificial intelligence technologies, Chief Information Security Officers (CISOs) are feeling the pressure. A recent survey revealed that 26% of these top security executives are contemplating leaving their roles due to the heightened demands and risks associated with AI. This shift in focus comes as organizations scramble to integrate AI tools while also managing potential vulnerabilities and security threats that could arise from their use. The concerns reflect a broader challenge in balancing innovation with security, as companies must ensure they are protecting sensitive data and maintaining compliance amidst rapid technological changes. The implications of this trend could lead to a shake-up in security leadership and strategy as organizations seek to address both the opportunities and risks presented by AI.

Jul 20, 2026

Attackers Combo Up Evasion Tactics for BEC Phishing

darkreading

A new phishing campaign, dubbed 'The TFF Trap', employs sophisticated evasion tactics to execute business email compromise (BEC) attacks. This method utilizes fileless techniques and low-detection loaders to deploy various remote access trojans (RATs) and stealers, including Agent Tesla, Remcos, XWorm, and Best Private Logger. The attackers aim to infiltrate corporate networks and steal sensitive information. Organizations should be on high alert, as these tactics make it challenging for traditional security measures to detect the malicious activities. Companies must bolster their email security practices and educate employees on recognizing phishing attempts to mitigate the risks associated with this evolving threat.

Jul 20, 2026

FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

The Hacker News

Researchers have identified around 7,600 malicious repositories on GitHub as part of a campaign called FakeGit. Over 800 of these repositories masquerade as AI projects or Model Context Protocol (MCP) servers, with the aim of distributing SmartLoader malware. This malware targets users by using copied projects and convincing documentation to lure them into downloading harmful files. The campaign is particularly concerning because it exploits the popularity of AI and related technologies, making it more likely for unsuspecting developers and users to fall victim. As a result, it’s crucial for individuals and organizations to be vigilant when downloading software from GitHub and to verify the authenticity of repositories before engaging with them.

Jul 20, 2026

Director of Commerce AI standards office out after three months

CyberScoop

The Director of the newly formed Center for AI Standards and Innovation, part of the Department of Commerce, has left the position after just three months. This center was established to evaluate the risks and challenges associated with artificial intelligence technologies. The sudden departure raises questions about leadership stability and the future direction of the center, which plays a pivotal role in shaping federal AI policy. With AI systems increasingly integrated into various sectors, effective oversight is crucial to mitigate potential harms. The vacancy may hinder efforts to develop comprehensive standards that ensure AI technologies are safe and beneficial for society.

Jul 20, 2026

Cruciferra Crypter Uses Process Ghosting to Evade Detection

Infosecurity Magazine

Researchers have identified a new crypter known as Cruciferra that employs advanced techniques to evade detection by security software. This crypter utilizes a method called process ghosting, along with 90 custom ciphers, to obscure malicious payloads for various cyber actors. The ability to hide effectively means that malware can be deployed without triggering alarms, making it a significant concern for cybersecurity professionals. The techniques used by Cruciferra can complicate the detection and analysis of threats, potentially allowing attackers to compromise systems more easily. As this method becomes more widespread, organizations need to enhance their defenses and monitoring to counteract these stealthy tactics.

Jul 20, 2026

ServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875)

Help Net Security

A critical vulnerability in the ServiceNow AI Platform, identified as CVE-2026-6875, is being actively exploited by attackers. This pre-authentication code injection flaw allows unauthenticated users to escape the platform's script sandbox and execute arbitrary code on targeted instances. Researchers from Searchlight Cyber discovered this vulnerability and reported it to ServiceNow in early April 2026. The exploitation of this vulnerability poses significant risks to organizations using the ServiceNow AI Platform, as it could lead to unauthorized access and control over sensitive workflows and data. Companies are urged to take immediate action to safeguard their systems against potential attacks.

Jul 20, 2026