What is the CVSS score of CVE-2026-32666?

CVE-2026-32666 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Webctrl Premium Server are affected by CVE-2026-32666?

WebCTRL Premium Server systems are vulnerable to authentication bypass attacks through spoofed network packets, potentially allowing unauthorized actors to compromise building automation systems.

How to fix or mitigate CVE-2026-32666?

Within 24 hours: Identify and inventory all WebCTRL Premium Server installations and assess network exposure. Within 7 days: Implement network segmentation to isolate BACnet traffic and restrict access to trusted systems only; enable detailed logging of BACnet communications. Within 30 days: Establish a formal compensating controls program; evaluate alternative products or request timeline from vendor for patch availability; conduct security assessment of all dependent automation systems.

Webctrl Premium Server CVE-2026-32666

EUVD-2026-13861 HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-03-20 icscert

Authentication Bypass Webctrl Premium Server Automated Logic

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 23:31 euvd

EUVD-2026-13861

Analysis Generated

Mar 20, 2026 - 23:31 vuln.today

CVE Published

Mar 20, 2026 - 23:17 nvd

HIGH 7.5

DescriptionCVE.org

WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additional validation of BACnet traffic so an attacker with network access could spoof BACnet packets directed at either the WebCTRL server or associated AutomatedLogic controllers. Spoofed packets may be processed as legitimate.

AnalysisAI

WebCTRL Premium Server systems contain an authentication bypass vulnerability arising from BACnet protocol's inherent lack of network layer authentication, compounded by WebCTRL's failure to implement additional validation. An attacker with network access can spoof BACnet packets targeting either the WebCTRL server or associated AutomatedLogic controllers, which will process the spoofed packets as legitimate traffic. This vulnerability has a CVSS score of 7.5 with high integrity impact and is disclosed through ICS-CERT advisory ICSA-26-078-08.

Technical ContextAI

The vulnerability affects WebCTRL Premium Server (CPE: cpe:2.3:a:automated_logic:webctrl_premium_server:*:*:*:*:*:*:*:*), which is a building automation system that relies on BACnet (Building Automation and Control Networks) protocol for communication with field controllers and devices. BACnet is an ASHRAE/ANSI/ISO standard protocol widely used in building automation but lacks built-in network layer authentication mechanisms. The root cause is classified as CWE-290 (Authentication Bypass by Spoofing), where the system fails to verify the authenticity of network communication sources. WebCTRL does not compensate for BACnet's protocol-level security deficiencies by implementing application-layer authentication or cryptographic verification of packet sources, allowing any attacker who can reach the BACnet network to inject malicious commands that appear legitimate.

RemediationAI

Consult the ICS-CERT advisory ICSA-26-078-08 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08 and Automated Logic's security commitment page at https://www.automatedlogic.com/en/company/security-commitment/ for official vendor guidance on patches or firmware updates. As immediate mitigation, implement network segmentation to isolate BACnet networks from untrusted networks, deploy firewalls to restrict BACnet protocol traffic (UDP ports 47808 and TCP 47808) to only authorized devices, and consider implementing BACnet Secure Connect (BACnet/SC) if supported by the WebCTRL version or upgrade path. Use VPNs or other encrypted tunnels for any remote access to BACnet networks, implement network monitoring to detect anomalous BACnet traffic patterns, and conduct regular audits of devices authorized to communicate on the BACnet network.