CVE-2024-8528 Automated Logic CVE debrief

Who should care

OT and building-automation teams running Automated Logic WebCTRL Server, Carrier i-Vu, SiteScan Web, or WebCTRL for OEMs; application owners; and vulnerability/patch managers responsible for browser-based operator workflows.

Technical summary

According to the supplied CISA CSAF advisory, the issue is triggered by the wbs GET parameter being processed without sanitization and then rendered into a web page without proper escaping. That creates an opportunity for attacker-controlled script content to execute in the victim’s browser. The supplied CVSS vector (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) indicates user interaction is required and that the impact can extend across the browser trust boundary.

Defensive priority

High. Prioritize remediation on any active WebCTRL deployment because the issue is publicly documented, affects multiple product lines in the WebCTRL family, and is fixed in Web CTRL 9.0. Unsupported versions should be treated as migration/upgrade candidates rather than simple patch targets.

Recommended defensive actions

• Upgrade to the latest available version; Automated Logic states the vulnerability is remediated in Web CTRL 9.0.
• Inventory all affected WebCTRL-family deployments and confirm whether they are on supported releases.
• Plan replacement or upgrade for Web CTRL 7.0, Web CTRL 6.1, and i-Vu 6.0, which the advisory says are out of support.
• Review any application paths that use the wbs GET parameter and ensure user-supplied input is validated and escaped before rendering.
• Follow Automated Logic’s BAS security best-practices guidance and Carrier’s security advisories resources.

Evidence notes

CISA CSAF advisory ICSA-25-324-01, published 2025-11-20, states that the wbs GET parameter is not sanitized and that untrusted data is rendered without proper validation or escaping, enabling malicious script execution in a user’s browser. The advisory also states remediation is available in Web CTRL 9.0 and notes that Web CTRL 7.0, Web CTRL 6.1, and i-Vu 6.0 are out of support. No KEV entry or active-exploitation detail was supplied.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.