Arbitrary file upload in Automated Logic, A Carrier Company Webctrl
CVE-2024-8525
An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file.
Vulnerability class: Unrestricted File Upload
EPSS: 0.014 (70.3th percentile) — read the EPSS interpretation.
Affected products
- Automated Logic, A Carrier Company Webctrl — versions 7.0
- Carrier I-vu — versions 7.0
Weakness classification (CWE)
References
- productsecurity@carrier.com (vendor-advisory)
- productsecurity@carrier.com (government-resource)