What’s Vulnerable › Vulnerabilities

CVE-2026-24060: Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-21 · updated 2026-06-17
• Weakness: CWE-319

Description

Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. The proprietary format used by WebCTRL to receive updates from the PLC can also be sniffed and reverse engineered.

Affected products

• Automated Logic WebCTRL Premium Server: before v8.5 — fixed in v8.5

How to fix

Upgrade to a fixed version: Automated Logic WebCTRL Premium Server v8.5. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json
• https://www.automatedlogic.com/en/company/security-commitment/
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08

Get alerted when CVE-2026-24060 or the next vulnerability affects your stack