PT-2026-26712 · Automated Logic · Webctrl Premium

Jonathan Lee + 2 · Publicado 2026-03-20 · Atualizado 2026-03-21 · CVE-2026-24060

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Automated Logic WebCTRL Premium (affected versions not specified)

Description Service information is not encrypted when transmitted as BACnet packets over the network, allowing an attacker to sniff, intercept, and modify the data. Valuable information such as the File Start Position and File Data can be captured using tools like Wireshark with the BACnet dissector filter. The proprietary format used for updates from the PLC is also susceptible to sniffing and reverse engineering. This poses a serious threat as every HVAC command, sensor reading, and PLC update is exposed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2026-24060

Produtos afetados

Webctrl Premium

Referências · 9

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json · Nota
• https://reddit.com/r/pwnhub/comments/1rztt38/critical_bacnet_vulnerability_exposes_sensitive · Publicação no Reddit
• https://twitter.com/CveFindCom/status/2035155050457129397 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2035139135472546105 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2035262106908360998 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2035150382931091862 · Publicação no Twitter
• https://automatedlogic.com/en/company/security-commitment · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-24060 · Nota de Segurança
• https://cisa.gov/news-events/ics-advisories/icsa-26-078-08 · Nota