CVE-2024-8525 CRITICAL

CVE-2024-8525: Automated Logic WebCTRL and Carrier i-Vu Unrestricted File Upload

Vendor Automated Logic, A Carrier Company
Product WebCTRL
Weakness CWE-434 · Unrestricted file upload
Published November 21, 2024
Last update November 21, 2024
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file.

Key dates

02Disclosure timeline

November 21, 2024 CVE published
November 21, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-32836 WordPress WP-Lister Lite for eBay plugin <= 3.5.11 - Arbitrary File Upload vulnerability CVE-2023-4817 Unrestricted file upload vulnerability in ICP DAS ET-7060 CVE-2022-2872 Unrestricted Upload of File with Dangerous Type in octoprint/octoprint CVE-2022-2111 Unrestricted Upload of File with Dangerous Type in inventree/inventree CVE-2025-64231 WordPress WordPress Contact Form 7 PDF, Google Sheet & Database plugin <= 3.0.0 - Arbitrary File Upload vulnerability