https://vulnogram.org/ Most recent CVEs assigned by Carrier Global Corporation (carrier). https://vulnogram.org/seaview/icons/carrier.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2025-14295 https://vulnogram.org/CVE-2025-14295 Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Format vulnerability (CWE-257) in the Web session management component allows an attacker to ac… High Thu, 22 Jan 2026 12:52:14 GMT https://vulnogram.org/CVE-2024-5540 https://vulnogram.org/CVE-2024-5540 The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allowing a malicious actor to compromise the client browser . Medium Network Exploitable Thu, 27 Nov 2025 01:02:48 GMT https://vulnogram.org/CVE-2024-5539 https://vulnogram.org/CVE-2024-5539 The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web based building automation s… Critical Network Exploitable Thu, 27 Nov 2025 01:02:30 GMT https://vulnogram.org/CVE-2025-0657 https://vulnogram.org/CVE-2025-0657 A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power c… High Network Exploitable Thu, 27 Nov 2025 01:00:59 GMT https://vulnogram.org/CVE-2025-0658 https://vulnogram.org/CVE-2025-0658 A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol causes the device to crash. The device enters a fault state; after a reset, a second packet can leave it permanently unresponsive until a manual power cycle is perfo… High Network Exploitable Thu, 27 Nov 2025 01:00:16 GMT https://vulnogram.org/CVE-2024-8528 https://vulnogram.org/CVE-2024-8528 Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized. Medium Wed, 19 Nov 2025 13:18:35 GMT https://vulnogram.org/CVE-2024-8527 https://vulnogram.org/CVE-2024-8527 Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions. High Wed, 19 Nov 2025 13:17:01 GMT https://vulnogram.org/CVE-2025-9495 https://vulnogram.org/CVE-2025-9495 The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictio… High Tue, 23 Sep 2025 01:16:53 GMT https://vulnogram.org/CVE-2025-9494 https://vulnogram.org/CVE-2025-9494 An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parame… High Tue, 23 Sep 2025 01:12:17 GMT https://vulnogram.org/CVE-2024-10930 https://vulnogram.org/CVE-2024-10930 An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated privileges. High Tue, 04 Mar 2025 17:21:39 GMT https://vulnogram.org/CVE-2024-8525 https://vulnogram.org/CVE-2024-8525 An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file. Critical Network Exploitable Unsupported When Assigned Thu, 21 Nov 2024 15:32:55 GMT https://vulnogram.org/CVE-2024-8526 https://vulnogram.org/CVE-2024-8526 A vulnerability in Automated Logic WebCTRL 7.0 could allow an attacker to send a maliciously crafted URL, which when visited by an authenticated WebCTRL user, could result in the redirection of the user to a malicious webpage via "index.jsp" Medium Network Exploitable Unsupported When Assigned Thu, 21 Nov 2024 15:29:55 GMT https://vulnogram.org/CVE-2024-2422 https://vulnogram.org/CVE-2024-2422 LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands. Critical Network Exploitable Thu, 30 May 2024 17:26:12 GMT https://vulnogram.org/CVE-2024-2421 https://vulnogram.org/CVE-2024-2421 LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions. Critical Network Exploitable Thu, 30 May 2024 17:24:33 GMT https://vulnogram.org/CVE-2024-2420 https://vulnogram.org/CVE-2024-2420 LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypass authentication requirements. High Network Exploitable Thu, 30 May 2024 17:22:06 GMT https://vulnogram.org/CVE-2023-36483 https://vulnogram.org/CVE-2023-36483 Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.24 and earlier which allows remote attackers to retrieve sensitive data including customer da… Medium Sat, 16 Mar 2024 00:00:00 GMT https://vulnogram.org/CVE-2022-31486 https://vulnogram.org/CVE-2022-31486 An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP450… High Mon, 06 Jun 2022 16:41:46 GMT https://vulnogram.org/CVE-2022-31485 https://vulnogram.org/CVE-2022-31485 An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and… Medium Network Exploitable Mon, 06 Jun 2022 16:41:09 GMT https://vulnogram.org/CVE-2022-31484 https://vulnogram.org/CVE-2022-31484 An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain… High Network Exploitable Mon, 06 Jun 2022 16:40:33 GMT https://vulnogram.org/CVE-2022-31483 https://vulnogram.org/CVE-2022-31483 An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501,… Critical Mon, 06 Jun 2022 16:39:56 GMT https://vulnogram.org/CVE-2022-31482 https://vulnogram.org/CVE-2022-31482 An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP450… High Network Exploitable Mon, 06 Jun 2022 16:39:22 GMT https://vulnogram.org/CVE-2022-31481 https://vulnogram.org/CVE-2022-31481 An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain f… Critical Network Exploitable Mon, 06 Jun 2022 16:38:51 GMT https://vulnogram.org/CVE-2022-31480 https://vulnogram.org/CVE-2022-31480 An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, a… High Network Exploitable Mon, 06 Jun 2022 16:37:36 GMT https://vulnogram.org/CVE-2022-31479 https://vulnogram.org/CVE-2022-31479 An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers L… Critical Network Exploitable Mon, 06 Jun 2022 16:36:46 GMT