Carrier

Latest CVEs · RSS

• CVE-2025-14295 2026-01-22 · CVSS 7.0
  Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Forma
• CVE-2024-5540 2025-11-27 · CVSS 6.9
  The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allowing a malicious a
• CVE-2024-5539 2025-11-27 · CVSS 9.2
  The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended ac
• CVE-2025-0657 2025-11-27 · CVSS 8.8
  A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed packets to be sent through BACnet MS/TP
• CVE-2025-0658 2025-11-27 · CVSS 8.7
  A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol causes the device to crash. The device enters a fault state; after a reset,
• CVE-2024-8528 2025-11-19 · CVSS 5.4
  Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being
• CVE-2024-8527 2025-11-19 · CVSS 8.6
  Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions.
• CVE-2025-9495 2025-09-23 · CVSS 8.7
  The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker
• CVE-2025-9494 2025-09-23 · CVSS 8.5
  An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. S
• CVE-2024-10930 2025-03-04 · CVSS 7.1
  An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated
• CVE-2024-8525 2024-11-21 · CVSS 10.0
  An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a
• CVE-2024-8526 2024-11-21 · CVSS 5.9
  A vulnerability in Automated Logic WebCTRL 7.0 could allow an attacker to send a maliciously crafted URL, which when visited by an authenticated WebCTRL user, c
• CVE-2024-2422 2024-05-30 · CVSS 9.3
  LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows
• CVE-2024-2421 2024-05-30 · CVSS 9.3
  LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allow
• CVE-2024-2420 2024-05-30 · CVSS 8.8
  LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows
• CVE-2023-36483 2024-03-16 · CVSS 6.5
  Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android  version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.
• CVE-2022-31486 2022-06-06 · CVSS 8.8
  An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts produ
• CVE-2022-31485 2022-06-06 · CVSS 5.3
  An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impacts
• CVE-2022-31484 2022-06-06 · CVSS 7.5
  An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HI
• CVE-2022-31483 2022-06-06 · CVSS 9.1
  An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem.
• CVE-2022-31482 2022-06-06 · CVSS 7.5
  An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts produ
• CVE-2022-31481 2022-06-06 · CVSS 10.0
  An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID
• CVE-2022-31480 2022-06-06 · CVSS 7.5
  An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impac
• CVE-2022-31479 2022-06-06 · CVSS 9.6
  An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection p