CVE-2024-5539 CRITICAL

CVE-2024-5539: ALC WebCTRL Carrier i-Vu Access Control Bypass

Vendor Automated Logic
Product WebCTRL
Weakness CWE-863 · Incorrect authorization
Published November 27, 2025
Last update November 28, 2025
View on NVD All CVEs

CVSS base score

9.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

What the vulnerability does

01Description

The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web based building automation server.

Key dates

02Disclosure timeline

November 27, 2025 CVE published
November 28, 2025 Record updated