{"id":"CVE-2026-24060","aliases":["EUVD-2026-13840","GHSA-79hg-m6px-6m7h"],"status":"published","title":"Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information","description":"Service information is not encrypted when transmitted as BACnet packets \nover the wire, and can be sniffed, intercepted, and modified by an \nattacker. Valuable information such as the File Start Position and File \nData can be sniffed from network traffic using Wireshark's BACnet \ndissector filter. The proprietary format used by WebCTRL to receive \nupdates from the PLC can also be sniffed and reverse engineered.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00208,"percentile":0.1097,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-319"],"published":"2026-03-20T23:19:05Z","modified":"2026-06-17T10:22:32Z","products":[{"vendor":"automated logic","product":"webctrl premium server"}],"references":[{"url":"https://www.automatedlogic.com/en/company/security-commitment/"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24060"},{"url":"https://www.automatedlogic.com/en/company/security-commitment"},{"url":"https://github.com/advisories/GHSA-79hg-m6px-6m7h"}],"sources":{"cve":[{"id":"CVE-2026-24060","title":"Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information","description":"Service information is not encrypted when transmitted as BACnet packets \nover the wire, and can be sniffed, intercepted, and modified by an \nattacker. Valuable information such as the File Start Position and File \nData can be sniffed from network traffic using Wireshark's BACnet \ndissector filter. The proprietary format used by WebCTRL to receive \nupdates from the PLC can also be sniffed and reverse engineered.","status":"published","published":"2026-03-20T23:19:05.223Z","modified":"2026-03-23T15:55:53.047Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-319","CWE-319"],"updated_at":"2026-11-02T14:19:50.575061Z"}],"euvd":[{"id":"EUVD-2026-13840","description":"Service information is not encrypted when transmitted as BACnet packets \nover the wire, and can be sniffed, intercepted, and modified by an \nattacker. Valuable information such as the File Start Position and File \nData can be sniffed from network traffic using Wireshark's BACnet \ndissector filter. The proprietary format used by WebCTRL to receive \nupdates from the PLC can also be sniffed and reverse engineered.","status":"published","published":"2026-03-20T23:19:05Z","modified":"2026-03-23T15:55:53Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:25:31.168902Z"}],"ghsa":[{"id":"GHSA-79hg-m6px-6m7h","title":"Service information is not encrypted when transmitted as BACnet packets \nover the wire, and can...","description":"Service information is not encrypted when transmitted as BACnet packets \nover the wire, and can be sniffed, intercepted, and modified by an \nattacker. Valuable information such as the File Start Position and File \nData can be sniffed from network traffic using Wireshark's BACnet \ndissector filter. The proprietary format used by WebCTRL to receive \nupdates from the PLC can also be sniffed and reverse engineered.","status":"published","published":"2026-03-21T00:31:44Z","modified":"2026-03-21T00:32:49Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T15:06:44.698439Z"}],"nvd":[{"id":"CVE-2026-24060","description":"Service information is not encrypted when transmitted as BACnet packets \nover the wire, and can be sniffed, intercepted, and modified by an \nattacker. Valuable information such as the File Start Position and File \nData can be sniffed from network traffic using Wireshark's BACnet \ndissector filter. The proprietary format used by WebCTRL to receive \nupdates from the PLC can also be sniffed and reverse engineered.","status":"published","published":"2026-03-21T00:16:25.483Z","modified":"2026-06-17T10:22:32.31Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:12:10.126802Z"}]}}