CVE-2026-32666— Automated Logic WebCTRL Premium Server Authentication Bypass by Spoofing
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-32666
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Automated Logic WebCTRL Premium Server Authentication Bypass by Spoofing
Source: NVD (National Vulnerability Database)
Vulnerability Description
WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additional validation of BACnet traffic so an attacker with network access could spoof BACnet packets directed at either the WebCTRL server or associated AutomatedLogic controllers. Spoofed packets may be processed as legitimate.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用欺骗进行的认证绕过
Source: NVD (National Vulnerability Database)
Vulnerability Title
Automated Logic WebCtrl 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Automated Logic WebCtrl是美国Automated Logic公司的一个基于 Web 的楼宇自动化系统的服务器。 Automated Logic WebCtrl存在安全漏洞，该漏洞源于缺乏网络层身份验证，可能导致伪造的BACnet数据包被处理。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Automated Logic | WebCTRL Premium Server | 0 ~ v8.5 | - |
II. Public POCs for CVE-2026-32666
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-32666
请登录查看更多情报信息。
Same Patch Batch · Automated Logic · 2026-03-20 · 3 CVEs total
| CVE-2026-24060 | 9.1 CRITICAL | Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information |
| CVE-2026-25086 | 7.7 HIGH | Automated Logic WebCTRL Premium Server Multiple Binds to the Same Port |
IV. Related Vulnerabilities
Same vendor: Automated Logic
- CVE-2026-24060
Automated Logic WebCTRL Premium Server Cleartext Transmissio - CVE-2026-25086
Automated Logic WebCTRL Premium Server Multiple Binds to the - CVE-2025-14295
Automated Logic WebCTRL and Carrier i-Vu Session Fixation - CVE-2024-5540
ALC WebCTRL Carrier i-Vu Reflected Cross-Site Scripting - CVE-2024-5539
ALC WebCTRL Carrier i-Vu Access Control Bypass
Same weakness: CWE-290
- CVE-2021-47923
OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie - CVE-2026-42354
Sentry: Improper authentication on SAML SSO process allows u - CVE-2026-44118
OpenClaw < 2026.4.22 - Owner Context Spoofing via Bearer Tok - CVE-2026-39858
Traefik: Forwarded alias spoofing top pre-auth decision bypa - CVE-2018-25318
Tenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS Cha
V. Comments for CVE-2026-32666
No comments yet