CVE-2024-5539
CriticalSummary
The Access Control Bypass vulnerability in ALC WebCTRL and Carrier i-Vu up to and including version 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web-based building automation server.
Risk Assessment
An attacker could gain unauthorized access to sensitive building automation data, potentially compromising physical security and information confidentiality.
Recommendation
Update ALC WebCTRL and Carrier i-Vu to a version later than 8.5. Restrict access to the building automation server to authorized users only.
Original NVD description (English source)
The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web based building automation server.