Back to Database
Status published
Critical
CVE-2024-5539
ALC WebCTRL Carrier i-Vu Access Control Bypass
Vulnerability Description
The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web based building automation server.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-5539
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Steve Knabe from Praetorian
More from Automated Logic
View All →CVE-2025-14295
Automated Logic WebCTRL and Carrier i-Vu Session Fixation
High
7
CVE-2025-0658
Automated Logic and Carrier Zone Controllers malformed packets denial of service
High
8.7
CVE-2025-0657
ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range
High
8.8
CVE-2024-8528
ALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameter
Medium
5.4
CVE-2024-8527
ALC WebCTRL Carrier i-Vu Open Redirect via URL parameter
High
8.6
Affected Vendor
Automated Logic
View all reports →Affected Software
WebCTRL, i-Vu
Vulnerable Versions:
0
Timeline
Official Publish:
November 27th, 2025
Last Modified:
November 28th, 2025
Added to House:
July 22nd, 2026