{"id":"CVE-2026-32666","aliases":["EUVD-2026-13861","GHSA-2v87-3m5p-q6cw"],"status":"published","title":"Automated Logic WebCTRL Premium Server Authentication Bypass by Spoofing","description":"WebCTRL systems that communicate over BACnet inherit the protocol's lack\n of network layer authentication. WebCTRL does not implement additional \nvalidation of BACnet traffic so an attacker with network access could \nspoof BACnet packets directed at either the WebCTRL server or associated\n AutomatedLogic controllers. Spoofed packets may be processed as \nlegitimate.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00348,"percentile":0.28653,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-290"],"published":"2026-03-20T23:17:29Z","modified":"2026-06-17T10:36:11Z","products":[{"vendor":"automated logic","product":"webctrl premium server"}],"references":[{"url":"https://www.automatedlogic.com/en/company/security-commitment/"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32666"},{"url":"https://www.automatedlogic.com/en/company/security-commitment"},{"url":"https://github.com/advisories/GHSA-2v87-3m5p-q6cw"}],"sources":{"cve":[{"id":"CVE-2026-32666","title":"Automated Logic WebCTRL Premium Server Authentication Bypass by Spoofing","description":"WebCTRL systems that communicate over BACnet inherit the protocol's lack\n of network layer authentication. WebCTRL does not implement additional \nvalidation of BACnet traffic so an attacker with network access could \nspoof BACnet packets directed at either the WebCTRL server or associated\n AutomatedLogic controllers. Spoofed packets may be processed as \nlegitimate.","status":"published","published":"2026-03-20T23:17:29.342Z","modified":"2026-03-23T15:56:02.688Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-290","CWE-290"],"updated_at":"2026-11-02T14:19:57.100857Z"}],"euvd":[{"id":"EUVD-2026-13861","description":"WebCTRL systems that communicate over BACnet inherit the protocol's lack\n of network layer authentication. WebCTRL does not implement additional \nvalidation of BACnet traffic so an attacker with network access could \nspoof BACnet packets directed at either the WebCTRL server or associated\n AutomatedLogic controllers. Spoofed packets may be processed as \nlegitimate.","status":"published","published":"2026-03-20T23:17:29Z","modified":"2026-03-23T15:56:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:25:31.168902Z"}],"ghsa":[{"id":"GHSA-2v87-3m5p-q6cw","title":"WebCTRL systems that communicate over BACnet inherit the protocol's lack\n of network layer...","description":"WebCTRL systems that communicate over BACnet inherit the protocol's lack\n of network layer authentication. WebCTRL does not implement additional \nvalidation of BACnet traffic so an attacker with network access could \nspoof BACnet packets directed at either the WebCTRL server or associated\n AutomatedLogic controllers. Spoofed packets may be processed as \nlegitimate.","status":"published","published":"2026-03-21T00:31:44Z","modified":"2026-03-21T00:31:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:06:44.698439Z"}],"nvd":[{"id":"CVE-2026-32666","description":"WebCTRL systems that communicate over BACnet inherit the protocol's lack\n of network layer authentication. WebCTRL does not implement additional \nvalidation of BACnet traffic so an attacker with network access could \nspoof BACnet packets directed at either the WebCTRL server or associated\n AutomatedLogic controllers. Spoofed packets may be processed as \nlegitimate.","status":"published","published":"2026-03-21T00:16:26.22Z","modified":"2026-06-17T10:36:11.007Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:12:10.126802Z"}]}}