CVE-2024-8528: ALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameter

Severity: medium (CVSS 5.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-19 · updated 2026-06-17
Weakness: CWE-79

Description

Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized.

Affected products

Automated Logic WebCtrl: from 6.0 through 9.0
Carrier i-Vu: from 6.0 through 9.0

References

https://www.corporate.carrier.com/product-security/advisories-resources/

Get alerted when CVE-2024-8528 or the next vulnerability affects your stack