What is the CVSS score of CVE-2026-24060?

CVE-2026-24060 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Webctrl Premium Server are affected by CVE-2026-24060?

Automated Logic WebCTRL Premium Servers are transmitting sensitive building automation data in unencrypted format, allowing network-based attackers to intercept and potentially modify critical…

How to fix or mitigate CVE-2026-24060?

Within 24 hours: Inventory all WebCTRL Premium Server instances and document network connectivity; restrict network access to these systems using firewall rules to trusted administrative networks only. Within 7 days: Implement network segmentation isolating BACnet traffic on a dedicated VLAN with access controls; conduct a forensic review of network logs for suspicious activity. Within 30 days: Develop and execute a migration plan to alternative building management solutions with encrypted communications; engage Automated Logic for a vendor-provided workaround or accelerated patch timeline; deploy network intrusion detection rules to alert on BACnet protocol anomalies.

Webctrl Premium Server CVE-2026-24060

EUVD-2026-13840 CRITICAL

Cleartext Transmission of Sensitive Information (CWE-319)

2026-03-20 icscert

Information Disclosure Webctrl Premium Server Automated Logic

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 23:46 euvd

EUVD-2026-13840

Analysis Generated

Mar 20, 2026 - 23:46 vuln.today

CVE Published

Mar 20, 2026 - 23:19 nvd

CRITICAL 9.1

DescriptionCVE.org

Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. The proprietary format used by WebCTRL to receive updates from the PLC can also be sniffed and reverse engineered.

AnalysisAI

This vulnerability affects Automated Logic's WebCTRL Premium Server, which transmits BACnet protocol data in cleartext without encryption. An attacker positioned on the network can sniff sensitive service information including File Start Position, File Data, and proprietary PLC update formats using tools like Wireshark, enabling both information disclosure and potential integrity attacks through modification of intercepted traffic. With a CVSS score of 9.1 (Critical) and network-based attack vector requiring no privileges or user interaction, this represents a significant exposure for building automation systems.

Technical ContextAI

The vulnerability stems from CWE-319 (Cleartext Transmission of Sensitive Information) in the BACnet protocol implementation used by WebCTRL Premium Server. BACnet (Building Automation and Control Networks) is a widely deployed protocol for building automation systems, enabling communication between HVAC, lighting, and access control devices. The affected product is identified by CPE cpe:2.3:a:automated_logic:webctrl_premium_server:*:*:*:*:*:*:*:*, indicating the vulnerability affects the premium server product across versions. The lack of encryption at the protocol level means all BACnet packets—including file transfer operations and proprietary WebCTRL-to-PLC update communications—traverse the network in cleartext, readily accessible through standard network analysis tools with built-in BACnet dissector capabilities.

RemediationAI

Organizations should immediately consult the CISA ICS advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08 and Automated Logic's security commitment page at https://www.automatedlogic.com/en/company/security-commitment/ for specific patch availability and upgrade instructions. The structured CSAF file available at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json provides machine-readable remediation details. As an interim mitigation until patching is complete, isolate WebCTRL systems on dedicated network segments using VLANs, implement strict firewall rules limiting BACnet traffic to only authorized devices, deploy network intrusion detection systems to monitor for suspicious BACnet packet capture or manipulation attempts, and consider implementing VPN or encrypted tunnel overlays for BACnet communications. Network segmentation is critical to reduce the attack surface for this cleartext protocol vulnerability.