CVE-2026-24060 - Vulnerability Analysis

Overview

WebCTRL transmits BACnet packets without encryption, allowing attackers to sniff and modify sensitive service information like File Start Position and File Data over the network, exploit requires network access.

Severity & Score

Impact

Attackers can intercept and modify sensitive BACnet service information, leading to information disclosure and data tampering.

Mitigation

Implement encryption for BACnet packet transmission or update to a version that secures network communications.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json
• https://www.automatedlogic.com/en/company/security-commitment/
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 21, 2026

🔴 CVE-2026-24060 - Critical (9.1) Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24060/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner