Detections
Analytics
Automated Logic WebCTRL Premium Server URL Redirection to Untrusted Site (CVE-2024-8527)
high Tenable OT Security Plugin ID 505498
Synopsis
The remote OT asset is affected by a vulnerability.Description
CWE-601 URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Automated Logic WebCTRL and Carrier i-Vu Building Automation System products. The application accepts a user-supplied URL and redirects without proper validation, allowing attackers to exploit user sessions through a combination of open redirect and cross-site scripting to redirect victims to malicious sites.This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.
Solution
The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.Automated Logic has reported the following:
- Users are advised to upgrade to the latest available version. These vulnerabilities have been remediated in Web CTRL 9.0.
- Web CTRL 7.0, Web CTRL 6.1, i-Vu 6.0 are out of support.
- Additionally, Users are encouraged to follow Automated Logic's [Security Best Practices Checklists for Building Automation Systems (BAS)](https://www.automatedlogic.com/en/media/Security Best Practices for a WebCTRL v8.0 system-522_tcm702-168128.pdf) to ensure alignment with best practices installation guidelines.
For more information, visit Carrier's security advisories: https://www.corporate.carrier.com/product- security/advisories-resources/
See Also
https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-01
Plugin Details
Severity: High
ID: 505498
File Name: tenable_ot_automatedlogiccorporation_CVE-2024-8527.nasl
Version: 1.3
Type: Remote
Family: Tenable.ot
Published: 6/23/2026
Updated: 6/25/2026
Supported Sensors: Tenable OT Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 9.39
CVSS v3
Risk Factor: High
Base Score: 8.2
Temporal Score: 7.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.6
Threat Score: 6.1
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Vulnerability Information
CPE: cpe:/a:automatedlogic:webctrl_server
Required KB Items: Tenable.ot/AutomatedLogicCorporation
Exploit Ease: No known exploits are available
Patch Publication Date: 11/18/2025
Vulnerability Publication Date: 11/18/2025
Reference Information
CVE: CVE-2024-8527
CWE: 601