Description
An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Automated Logic, a Carrier company | WebCTRL | 7.0 | — |
| Carrier | i-Vu | 7.0 | — |
Advisories 1
- ICSA-24-326-01 Automated Logic WebCTRL Premium Server CISA ICS & IT advisories · Nov 21, 2024
References
- https://www.corporate.carrier.com/product-security/advisories-resources/ vendor-advisory
- https://www.cisa.gov/news-events/ics-advisories/ government-resource