Automated Logic WebCTRL Premium Server URL Redirection to Untrusted Site (CVE-2024-8527)

high Tenable OT Security Plugin ID 505499

Synopsis

The remote OT asset is affected by a vulnerability.

Description

CWE-601 URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Automated Logic WebCTRL and Carrier i-Vu Building Automation System products. The application accepts a user-supplied URL and redirects without proper validation, allowing attackers to exploit user sessions through a combination of open redirect and cross-site scripting to redirect victims to malicious sites.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Automated Logic has reported the following:

- Users are advised to upgrade to the latest available version. These vulnerabilities have been remediated in Web CTRL 9.0.
- Web CTRL 7.0, Web CTRL 6.1, i-Vu 6.0 are out of support.
- Additionally, Users are encouraged to follow Automated Logic's [Security Best Practices Checklists for Building Automation Systems (BAS)](https://www.automatedlogic.com/en/media/Security Best Practices for a WebCTRL v8.0 system-522_tcm702-168128.pdf) to ensure alignment with best practices installation guidelines.

For more information, visit Carrier's security advisories: https://www.corporate.carrier.com/product- security/advisories-resources/

Plugin Details

Severity: High

ID: 505499

File Name: tenable_ot_carriercorporation_CVE-2024-8527.nasl

Version: 1.3

Type: Remote

Family: Tenable.ot

Published: 6/23/2026

Updated: 6/25/2026

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.39

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.6

Threat Score: 6.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Vulnerability Information

CPE: cpe:/a:automatedlogic:i-vu

Required KB Items: Tenable.ot/CarrierCorporation

Exploit Ease: No known exploits are available

Patch Publication Date: 11/18/2025

Vulnerability Publication Date: 11/18/2025

Reference Information

CVE: CVE-2024-8527

CWE: 601

Detections

Analytics