CVE-2026-32666

WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additional validation of BACnet traffic so an attacker with network access could spoof BACnet packets directed at either the WebCTRL server or associated AutomatedLogic controllers. Spoofed packets may be processed as legitimate.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json
https://www.automatedlogic.com/en/company/security-commitment/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08

Configurations

No configuration.

History

17 Jun 2026, 10:36

Type	Values Removed	Values Added
Summary		(es) Los sistemas WebCTRL que se comunican a través de BACnet heredan la falta de autenticación de capa de red del protocolo. WebCTRL no implementa validación adicional del tráfico BACnet, por lo que un atacante con acceso a la red podría falsificar paquetes BACnet dirigidos tanto al servidor WebCTRL como a los controladores AutomatedLogic asociados. Los paquetes falsificados pueden ser procesados como legítimos.

21 Mar 2026, 00:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-21 00:16

Updated : 2026-06-17 10:36

NVD link : CVE-2026-32666

Mitre link : CVE-2026-32666

CVE.ORG link : CVE-2026-32666

JSON object : View

Products Affected

No product.

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2026-32666", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "ics-cert@hq.dhs.gov"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32666", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T14:49:42.712836Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ics-cert@hq.dhs.gov", "affectedData": [{"vendor": "Automated Logic", "product": "WebCTRL Premium Server", "versions": [{"status": "affected", "version": "0", "lessThan": "v8.5", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-21T00:16:26.220", "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.automatedlogic.com/en/company/security-commitment/", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08", "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-290"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "WebCTRL systems that communicate over BACnet inherit the protocol's lack\n of network layer authentication. WebCTRL does not implement additional \nvalidation of BACnet traffic so an attacker with network access could \nspoof BACnet packets directed at either the WebCTRL server or associated\n AutomatedLogic controllers. Spoofed packets may be processed as \nlegitimate."}, {"lang": "es", "value": "Los sistemas WebCTRL que se comunican a trav\u00e9s de BACnet heredan la falta de autenticaci\u00f3n de capa de red del protocolo. WebCTRL no implementa validaci\u00f3n adicional del tr\u00e1fico BACnet, por lo que un atacante con acceso a la red podr\u00eda falsificar paquetes BACnet dirigidos tanto al servidor WebCTRL como a los controladores AutomatedLogic asociados. Los paquetes falsificados pueden ser procesados como leg\u00edtimos."}], "lastModified": "2026-06-17T10:36:11.007", "sourceIdentifier": "ics-cert@hq.dhs.gov"}