CVE-2026-24060CWE-319

Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information

Critical · published March 20, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
9.8
In the wild
Unconfirmed
What it is

Service information is not encrypted when transmitted as BACnet packets

over the wire, and can be sniffed, intercepted, and modified by an

attacker. Valuable information such as the File Start Position and File

Data can be sniffed from network traffic using Wireshark's BACnet

dissector filter. The proprietary format used by WebCTRL to receive

updates from the PLC can also be sniffed and reverse engineered.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00203 · 9.8th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2026-03-20T23:19Z
EPSS history
Timeline
  • 20 MAR 23:19Z
    Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information
    cvelistv5