CVE-2026-25086

HIGH7.7

Automated Logic WebCTRL Premium Server Multiple Binds to the Same Port

Published Mar 20, 2026

Modified 2 months ago

Details

Under certain conditions, an attacker could bind to the same port used by WebCTRL. This could allow the attacker to craft and send malicious packets and impersonate the WebCTRL service without requiring code injection into the WebCTRL software.

References

WEB

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json

WEB

https://www.automatedlogic.com/en/company/security-commitment/

WEB

https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-25086

CVSS Analysis

CVSS v3.1

7.7

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

NoneA:N

7.7/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness Type (CWE)

Other

CWE-605

Ecosystems

Timeline

PublishedMar 20, 2026

ModifiedMar 23, 2026