CVE-2026-32666

HIGH

7.5

Description

WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additional validation of BACnet traffic so an attacker with network access could spoof BACnet packets directed at either the WebCTRL server or associated AutomatedLogic controllers. Spoofed packets may be processed as legitimate.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published3/21/2026

Last Modified3/23/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-290CWE-290

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json(ics-cert@hq.dhs.gov)

https://www.automatedlogic.com/en/company/security-commitment/(ics-cert@hq.dhs.gov)

https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08(ics-cert@hq.dhs.gov)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.