Detections
Analytics
Automated Logic WebCTRL Premium Server Improper Neutralization of Input During Web Page Generation (CVE-2024-8528)
medium Tenable OT Security Plugin ID 505505
Synopsis
The remote OT asset is affected by a vulnerability.Description
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in Automated Logic WebCTRL and Carrier i-Vu Building Automation System products. User input is not properly sanitized, allowing injection of malicious scripts into web pages viewed by users.This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.
Solution
The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.Automated Logic has reported the following:
- Users are advised to upgrade to the latest available version. These vulnerabilities have been remediated in Web CTRL 9.0.
- Web CTRL 7.0, Web CTRL 6.1, i-Vu 6.0 are out of support.
- Additionally, Users are encouraged to follow Automated Logic's [Security Best Practices Checklists for Building Automation Systems (BAS)](https://www.automatedlogic.com/en/media/Security Best Practices for a WebCTRL v8.0 system-522_tcm702-168128.pdf) to ensure alignment with best practices installation guidelines.
For more information, visit Carrier's security advisories: https://www.corporate.carrier.com/product- security/advisories-resources/
See Also
https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-01
Plugin Details
Severity: Medium
ID: 505505
File Name: tenable_ot_automatedlogiccorporation_CVE-2024-8528.nasl
Version: 1.3
Type: Remote
Family: Tenable.ot
Published: 6/23/2026
Updated: 6/25/2026
Supported Sensors: Tenable OT Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 9.39
CVSS v3
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 5.4
Threat Score: 2
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Vulnerability Information
CPE: cpe:/a:automatedlogic:webctrl_server
Required KB Items: Tenable.ot/AutomatedLogicCorporation
Exploit Ease: No known exploits are available
Patch Publication Date: 11/18/2025
Vulnerability Publication Date: 11/18/2025
Reference Information
CVE: CVE-2024-8528
CWE: 79