CVE-2022-1019 - CVE House
Back to Database
Status published Medium CVE-2022-1019

Automated Logic WebCtrl Server Open Redirection Vulnerability

Vulnerability Description

Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously crafted URL which could result in redirecting the user to a malicious webpage or downloading a malicious file.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-1019

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Chizuru Toyama from Trend Micro

References

More from Automated Logic

View All →
CVE-2025-14295
Automated Logic WebCTRL and Carrier i-Vu Session Fixation
High 7
CVE-2025-0658
Automated Logic and Carrier Zone Controllers malformed packets denial of service
High 8.7
CVE-2025-0657
ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range
High 8.8
CVE-2024-8528
ALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameter
Medium 5.4
CVE-2024-8527
ALC WebCTRL Carrier i-Vu Open Redirect via URL parameter
High 8.6

Affected Vendor

Automated Logic

View all reports →

Affected Software

WebCtrl Server
Vulnerable Versions:
All

Timeline

Official Publish: April 19th, 2022
Last Modified: April 16th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-601

MITRE ATT&CK TTPs

T1566 Phishing
Initial Access
T1204 User Execution
Execution
T1071 Application Layer Protocol
Command and Control
T1189 Drive-by Compromise
Initial Access
T1036 Masquerading
Defense Evasion