Automated Logic WebCTRL Premium Server Authentication Bypass by Spoofing

WebCTRL systems that communicate over BACnet inherit the protocol's lack

of network layer authentication. WebCTRL does not implement additional

validation of BACnet traffic so an attacker with network access could

spoof BACnet packets directed at either the WebCTRL server or associated

AutomatedLogic controllers. Spoofed packets may be processed as

legitimate.