Skip to content
OpenAdvisories
Critical ICSA-24-326-01 2 CVEs

Automated Logic WebCTRL Premium Server

Published Nov 21, 2024 · Updated Nov 21, 2024

Vendor: Automated Logic Product: Carrier i-Vu Product: SiteScan Web Product: WebCTRL for OEMs Product: WebCtrl Server

Summary

Successful exploitation of these vulnerabilities could allow an unauthenticated remote attacker to execute arbitrary commands on the server hosting WebCTRL or redirect legitimate users to malicious sites.

Vulnerabilities 2

  • Critical 10.0
    CVE-2024-8525

    Automated Logic WebCTRL and Carrier i-Vu Unrestricted File Upload

    An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file.

    Carrier Automated Logic, a Carrier company i-Vu WebCTRL
  • Medium 5.9
    CVE-2024-8526

    Automated Logic WebCTRL and Carrier i-Vu Open Redirect

    A vulnerability in Automated Logic WebCTRL 7.0 could allow an attacker to send a maliciously crafted URL, which when visited by an authenticated WebCTRL user, could result in the redirection of the user to a malicious webpage via "index.jsp"

    Carrier Automated Logic, a Carrier company i-Vu WebCTRL

Revision history

  1. #1

    Initial Publication

References