Loading vulnerability…
Open Redirect in Automated Logic WebCTRL and Carrier i-Vu
CVE-2024-8527 is a CWE-601 open redirect vulnerability in a URL parameter of Automated Logic WebCTRL and Carrier i-Vu. The application accepts an attacker-controlled URL and redirects a user to that destination without sufficient validation, enabling redirection to an untrusted or malicious website. Reported affected versions are WebCTRL and i-Vu 6.0, 6.5, 7.0, 8.0, 8.5, and 9.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker may use the redirect to send a legitimate user to a malicious website and may exploit user sessions. Such redirection can support phishing or bypass of security controls.
If you can’t patch tonight, do this now.
Minimize exposure of building-control systems to the internet. Place control-system networks and remote devices behind firewalls, isolate them from business networks, and use current VPN technology for remote access.
Patch, then assume compromise.
Update Automated Logic WebCTRL and Carrier i-Vu to a vendor-provided version that addresses the vulnerability and apply the relevant vendor patches. The available information is inconsistent regarding version 9.0: one advisory summary states the issues are remediated in WebCTRL 9.0, while the CVE description lists version 9.0 among affected versions. Confirm the fixed release with Automated Logic or Carrier before deployment.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.