Carrier
15 CVEs across 26 Carrier products. Browse Carrier vulnerabilities, severities, and proof-of-concept exploits.
Carrier products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14295 | | 2026-01-22 | Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Form… | |
CVE-2025-0658 | | 2025-11-27 | A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol causes the device to crash. The device enters a fault state; after a reset… | |
CVE-2025-0657 | | 2025-11-27 | A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed packets to be sent through BACnet MS/T… | |
CVE-2024-5540 | | 2025-11-27 | The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allowing a malicious… | |
CVE-2024-5539 | | 2025-11-27 | The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended a… | |
CVE-2024-8528 | | 2025-11-19 | Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not bein… | |
CVE-2024-8527 | | 2025-11-19 | Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions. | |
CVE-2024-10930 | High | 7.8 | 2025-03-04 | An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated… |
CVE-2024-8526 | | 2024-11-21 | A vulnerability in Automated Logic WebCTRL 7.0 could allow an attacker to send a maliciously crafted URL, which when visited by an authenticated WebCTRL user… | |
CVE-2024-8525 | | 2024-11-21 | An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a… | |
CVE-2022-31486 | High | 8.8 | 2022-06-06 | An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts prod… |
CVE-2022-31485 | Medium | 5.3 | 2022-06-06 | An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impact… |
CVE-2022-31484 | High | 7.5 | 2022-06-06 | An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on H… |
CVE-2022-31483 | Critical | 9.1 | 2022-06-06 | An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem… |
CVE-2022-31482 | High | 7.5 | 2022-06-06 | An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts prod… |
CVE-2022-31481 | Critical | 10.0 | 2022-06-06 | An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID… |
CVE-2022-31480 | High | 7.5 | 2022-06-06 | An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impa… |
CVE-2022-31479 | Critical | 9.6 | 2022-06-06 | An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection… |
CVE-2022-26519 | Medium | 5.5 | 2022-04-20 | There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Version 3002-19 interface, which allows loca… |
CVE-2022-1318 | Medium | 6.2 | 2022-04-20 | Hills ComNav version 3002-19 suffers from a weak communication channel. Traffic across the local network for the configuration pages can be viewed by a malicio… |
CVE-2020-19762 | Medium | 6.1 | 2021-02-22 | Automated Logic Corporation (ALC) WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for the first parameter… |
CVE-2018-8819 | High | 7.5 | 2018-06-14 | An XXE issue was discovered in Automated Logic Corporation (ALC) WebCTRL Versions 6.0, 6.1 and 6.5. An unauthenticated attacker could enter malicious input to… |
CVE-2016-5795 | High | 7.3 | 2017-08-31 | An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-V… |
CVE-2017-9650 | High | 7.8 | 2017-08-25 | An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC… |
CVE-2017-9644 | High | 7.0 | 2017-08-25 | An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteSc… |
CVE-2017-9640 | Medium | 6.3 | 2017-08-25 | A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScan Web 6.1 and prio… |