WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 21, 2026 · NIST NVD

   Detected

   WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additional validation of BACnet traffic so an attacker with network access could spoof BACnet packets directed at either the WebCTRL server or associated AutomatedLogic controllers. Spoofed packets may be processed as legitimate.

2. Jun 17, 2026 · NIST NVD

   Updated

   WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additional validation of BACnet traffic so an attacker with network access could spoof BACnet packets directed at either the WebCTRL server or associated AutomatedLogic controllers. Spoofed packets may be processed as legitimate.

Sources

• CVE.orgVulnerability recordCVE-2026-32666

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-32666

  WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additional validation of BACnet traffic so an attacker with network access could spoof BACnet packets directed at either the WebCTRL server or a

  nvd.nist.gov

References

• Reference · github.com
• Reference · automatedlogic.com
• Reference · cisa.gov