CVE-2022-1019 is an open-redirect vulnerability (CWE-601) in the 'Help' index pages of Automated Logic's WebCtrl Server, a Carrier building-management-system web front end: an attacker can send a user a maliciously crafted URL that silently redirects them to a malicious website or file download, and NVD rates it 6.1 (medium) on CVSS v3.1.
Vulnerability summary
6.1
Medium
0.7%
EPSS score (FIRST)
No
CISA KEV catalog
2022-04-19
Published
Vulnerability ID: CVE-2022-1019 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Automated Logic (Carrier) WebCtrl Server building-management-system software | cpe:2.3:a:automatedlogic:webctrl_server:*:*:*:*:*:*:*:* | WebCtrl Server through version 7.0 (NVD CPE: versionEndIncluding 7.0); affects the bundled 'Help' index pages |
What does this mean for affected devices?
CVE-2022-1019 affects WebCtrl Server, the web-based building-management-system platform sold by Automated Logic, a Carrier brand used for HVAC and building controls in commercial facilities. NVD's description states: "Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously crafted URL which could result in redirecting the user to a malicious webpage or downloading a malicious file" (NVD).
NVD records a Primary CVSS v3.1 base score of 6.1 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N — network-reachable, low attack complexity, requiring user interaction (clicking the crafted link) but no privileges, with low confidentiality and integrity impact and a scope change reflecting the redirect leaving the vulnerable component. The CISA ICS-CERT enrichment source recorded a lower Secondary score of 5.2 under a locally-scoped vector, CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, treating the attack as adjacent-network rather than fully remote; NVD also carries a legacy CVSS v2.0 Primary score of 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) (NVD). NVD's CPE applicability data scopes the affected product to cpe:2.3:a:automatedlogic:webctrl_server with versionEndIncluding 7.0, i.e. all WebCtrl Server releases up to and including 7.0.
Carrier published its own product security advisory PDF for this flaw, confirming the affected product as WebCtrl Server and recommending administrators contact an Automated Logic dealer to obtain the latest version, with an interim workaround of adding a Content Security Policy meta tag to the index.htm files inside the Help directory structure (Carrier CARR-PSA-ALC-WebCTRL-001).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0068 (52.7th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).
Sites running WebCtrl Server 7.0 or earlier should obtain an updated build from an Automated Logic dealer and, until then, apply Carrier's Content Security Policy workaround to the bundled Help pages to prevent the server from being used to redirect building-operator staff to malicious sites.
Evidence
- Automated Logic's WebCtrl Server 'Help' index pages, through version 7.0, are vulnerable to open redirection via a maliciously crafted URL, which can redirect the user to a malicious webpage or trigger a malicious file download. — NVD
- NVD Primary CVSS v3.1 score 6.1 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N; CISA ICS-CERT recorded a lower Secondary score of 5.2 under an adjacent-network vector. CPE data scopes WebCtrl Server up to and including version 7.0. — NVD
- Carrier's own product security advisory PDF confirms WebCtrl Server as the affected product, recommends obtaining the latest version via an Automated Logic dealer, and describes a Content Security Policy workaround for the Help index pages. — Carrier CARR-PSA-ALC-WebCTRL-001
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0068 (52.7th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What happens if a building operator clicks a malicious link exploiting CVE-2022-1019?
Visiting the crafted URL silently redirects their browser to an attacker-controlled webpage, or triggers the download of a malicious file, by abusing the open-redirect flaw in WebCtrl Server's bundled 'Help' index pages (per NVD).
Which WebCtrl Server versions are affected?
NVD's CPE applicability data scopes the flaw to all WebCtrl Server releases up to and including version 7.0 (per NVD).
Why do NVD and the CISA ICS-CERT score give different severity numbers for this CVE?
NVD's Primary score of 6.1 treats the flaw as fully network-reachable (AV:N), while the CISA ICS-CERT enrichment source scores it lower, 5.2, under an adjacent-network vector (AV:A) — the two sources modeled the attacker's required network position differently (per NVD).
How can a site running WebCtrl Server fix or mitigate this issue?
Carrier's advisory recommends contacting an Automated Logic dealer to obtain an updated WebCtrl Server build, and in the meantime applying a Content Security Policy meta tag to the index.htm files in the Help directory as an interim workaround (per Carrier CARR-PSA-ALC-WebCTRL-001).