Critical severity9.1NVD Advisory· Published Mar 21, 2026· Updated Jun 17, 2026

CVE-2026-24060

Description

Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. The proprietary format used by WebCTRL to receive updates from the PLC can also be sniffed and reverse engineered.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Automated Logic/WebCTRLllm-fuzzy
Automated Logic/Webctrl Premium Serverv5
Range: 0

Patches

Vulnerability mechanics

References

github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.jsonnvd
www.automatedlogic.com/en/company/security-commitment/nvd
www.cisa.gov/news-events/ics-advisories/icsa-26-078-08nvd

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000