What’s Vulnerable › Vulnerabilities

CVE-2024-5539: ALC WebCTRL Carrier i-Vu Access Control Bypass

• Severity: critical (CVSS 9.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-27 · updated 2026-06-17
• Weakness: CWE-863

Description

The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web based building automation server.

Affected products

• Automated Logic WebCtrl: through 8.5
• Carrier i-Vu: through 8.5

References

• https://www.corporate.carrier.com/product-security/advisories-resources/

Get alerted when CVE-2024-5539 or the next vulnerability affects your stack