Vulnerability · Published Mar 20, 2026 · Assigned by icscert
CVE-2026-24060Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information
Critical 9.1
In plain English
A critical-severity security flaw in WebCTRL Premium Server from Automated Logic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Official description
Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. The proprietary format used by WebCTRL to receive updates from the PLC can also be sniffed and reverse engineered.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Automated Logic | WebCTRL Premium Server | 0 – before v8.5 |
Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N