Auth bypass in Automated Logic Webctrl
CVE-2024-5539
The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web based building automation server.
Vulnerability class: Broken Access Control
EPSS: 0.003 (24.6th percentile) — read the EPSS interpretation.
Affected products
- Automated Logic Webctrl — versions 0
- Carrier I-vu — versions 0