209 matches found
PT-2026-26701
Name of the Vulnerable Software and Affected Versions WebCTRL affected versions not specified Description WebCTRL systems utilizing BACnet communication are susceptible to an issue stemming from the protocol's inherent lack of network layer authentication. The software does not perform additional...
๐ JUNG Smart Visu Server 1.1.1050 Denial of Service
Proof of concept exploit for a security vulnerability in JUNG Smart Visu Server version 1.1.1050 that allows unauthenticated remote attackers to trigger a system reboot or shutdown via a crafted HTTP POST request to a publicly exposed REST API endpoint...
็ผๅทๆคๅ
Computrols CBAS-Web is a building automation management platform developed by the American company Computrols. This CVE number has been withdrawn...
Johnson Controls Metasysโ various products have security vulnerabilities
Johnson Controls Metasys is a building automation platform developed by Johnson Controls, a company based in the United States. Several products of Johnson Controls Metasys have security vulnerabilities, which stem from improper handling of special elements in commands, potentially leading to...
Tinycontrol LAN Controller ๅฎๅ จๆผๆด
Tinycontrol LAN Controller is a building automation controller from Tinycontrol Poland. A security vulnerability exists in Tinycontrol LAN Controller version 1.58a, which stems from an authentication bypass that could lead to modification of administrator credentials...
CVE-2025-0658
A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol causes the device to crash. The device enters a fault state; after a reset, a second packet can leave it permanently unresponsive until a manual power cycle is performed...
CVE-2024-5539
The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web based building automation server...
EUVD-2024-55103
The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web based building automation server...
CVE-2024-5539
The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web based building automation server...
CVE-2025-0657
A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drvgen5106-01-2380, allows malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to return the device to network visibility...
CVE-2024-5539 ALC WebCTRL Carrier i-Vu Access Control Bypass
The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web based building automation server...
CVE-2024-5539
The CVE-2024-5539 entry concerns an Access Control Bypass in Automated Logic WebCTRL and Carrier i-Vu. Affected versions are up to and including 8.5. The vulnerability allows a malicious actor to bypass builtโin access restrictions and expose sensitive information via the web-based building autom...
CVE-2025-0658
The CVE-2025-0658 entry concerns Automated Logic and Carrierโs Zone Controller devices exposed to BACnet protocol. The vulnerability leads to a crash and a fault state; after a reset, a second BACnet packet can render the device permanently unresponsive until a manual power cycle. Documents consi...
PT-2025-48213
A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv gen5 106-01-2380, allows malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to return the device to network visibility...
Automated Logic Zone Controllers ๅฎๅ จๆผๆด
Automated Logic Zone Controllers is a hardware controller in a building automation system from Automated Logic USA. A security vulnerability exists in Automated Logic Zone Controllers that stems from the BACnet protocol causing the device to crash and may require manual power cycling to recover...
Automated Logic WebCtrlๅCarrier i-Vu ๅฎๅ จๆผๆด
Automated Logic WebCtrl is a server for web-based building automation systems from Automated Logic, Inc. and Carrier i-Vu is a building management system platform from Carrier Corporation. A security vulnerability exists in Automated Logic WebCtrl and Carrier i-Vu that stems from the presence of ...
Siemens APOGEE PXC and TALON TC Series Expected Behavior Violation (CVE-2025-40555)
Affected devices start sending unsolicited BACnet broadcast messages after processing a specific BACnet createObject request. This could allow an attacker residing in the same BACnet network to send a specially crafted message that results in a partial denial of service condition of the targeted...
6 Reasons Occupancy Monitoring Is Key for Energy Efficiency
Today, with the world more conscious than ever about the conservation of energy, efficiency becomes even more critical.โฆ...
Ilevia EVE X1/X5 Server 4.7.18.0.eden Default Credentials
Summary EVE is a smart home and building automation solution designed for both residential and commercial environments, including malls, hotels, restaurants, bars, gyms, spas, boardrooms, and offices. It enables comprehensive control and monitoring of electrical installations through a highly...
Ilevia EVE X1 Server 4.7.18.0.eden (mbus) Unauthenticated Remote Command Injection
Summary EVE is a smart home and building automation solution designed for both residential and commercial environments, including malls, hotels, restaurants, bars, gyms, spas, boardrooms, and offices. It enables comprehensive control and monitoring of electrical installations through a highly...