CVE-2024-8525 is an unrestricted-file-upload vulnerability (CWE-434) in Automated Logic's WebCTRL building-management server — the supervisory software, also sold as Carrier i-Vu, that HVAC and building-automation integrators use to monitor and control a building's BACnet controllers: an unauthenticated attacker can upload a malicious file via a crafted HTTP POST request and use it to execute arbitrary commands on the server. Carrier's own product-security team rated the flaw CVSS v4.0 10.0 (critical), but NVD has not, as of 2026-11-08, published its own Primary CVSS score — the 10.0 figure shown here is the vendor's Secondary submission, not an NVD-confirmed rating.
Vulnerability summary
CVSS base score
N/A
No NVD score published as of
EPSS score (FIRST)
1.4%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
No
Not listed
Published
Vulnerability ID: CVE-2024-8525 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Automated Logic WebCTRL building-management/BMS supervisory server (a Carrier company; the same codebase is also sold as Carrier i-Vu, Automated Logic SiteScan Web, and WebCTRL for OEMs — the central server software that HVAC/BMS integrators use to monitor and control building-automation controllers) | — | WebCTRL Server, Carrier i-Vu, SiteScan Web and WebCTRL for OEMs, version 7.0, per CISA's advisory; fixed in a later supported release |
What does this mean for affected devices?
CVE-2024-8525 (CWE-434, unrestricted upload of file with dangerous type) affects Automated Logic's WebCTRL Server software, a Carrier-company product used as the central supervisory server for BACnet-based building-management systems. NVD's description states: "An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file" (NVD).
NVD tracks CVE-2024-8525 with status "Deferred": it records only a Carrier PSIRT-submitted score (source [email protected]) — CVSS v4.0 10.0 (critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H — typed Secondary, not NVD's own Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD).
CISA's advisory ICSA-24-326-01, published 2024-11-21 alongside Carrier's own advisory CARR-PSA-2024-04, lists the affected products as WebCTRL Server v7.0, Carrier i-Vu v7.0, Automated Logic SiteScan Web v7.0 and WebCTRL for OEMs v7.0, places the vulnerability in the Critical Manufacturing sector with worldwide deployment, and credits researchers Jaryl Low, Thuy D. Nguyen and Cynthia E. Irvine with reporting it (CISA ICS Advisory ICSA-24-326-01). The same advisory disclosed a companion flaw, CVE-2024-8526, an open-redirect vulnerability in the same WebCTRL login flow (CISA ICS Advisory ICSA-24-326-01).
Carrier's remediation is a software update to a current, supported WebCTRL/i-Vu release; CISA's advisory adds its standard defense-in-depth guidance for control-system software of this kind: minimize network exposure for building-management servers, place them behind firewalls, and use VPNs with current patches for any remote access rather than exposing the server directly to the internet (CISA ICS Advisory ICSA-24-326-01).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01433 (73.222nd percentile) as of 2026-11-07 — a vendor-rated maximum-severity flaw in widely deployed BMS supervisory software, with no NVD Primary score yet and no reported in-the-wild exploitation (CISA KEV, FIRST EPSS).
NVD has not finished its own severity analysis of CVE-2024-8525. In the meantime, any WebCTRL Server or Carrier i-Vu v7.0 deployment should be updated to a current supported release and should not be reachable directly from the internet.
Evidence
- An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request. — NVD
- NVD status is 'Deferred' with a Carrier PSIRT-submitted Secondary CVSS v4.0 score of 10.0, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; no NVD-published Primary score as of this page's last update. — NVD
- CISA ICSA-24-326-01 (2024-11-21) names WebCTRL Server v7.0, Carrier i-Vu v7.0, SiteScan Web v7.0 and WebCTRL for OEMs v7.0 as affected; Critical Manufacturing sector, worldwide deployment; reported by Jaryl Low, Thuy D. Nguyen and Cynthia E. Irvine; documents companion open-redirect CVE-2024-8526; remediation is a software update, plus network segmentation and VPN-only remote access. — CISA ICS Advisory ICSA-24-326-01
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01433 (73.222nd percentile) as of 2026-11-07. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
What is CVE-2024-8525?
CVE-2024-8525 is an unrestricted-file-upload vulnerability (CWE-434) in Automated Logic's WebCTRL building-management server — the supervisory software, also sold as Carrier i-Vu, that HVAC and building-automation integrators use to monitor and control a building's BACnet controllers: an unauthenticated attacker can upload a malicious file via a crafted HTTP POST request and use it to execute arbitrary commands on the server. Carrier's own product-security team rated the flaw CVSS v4.0 10.0 (critical), but NVD has not, as of 2026-11-08, published its own Primary CVSS score — the 10.0 figure shown here is the vendor's Secondary submission, not an NVD-confirmed rating.
How severe is CVE-2024-8525?
CVE-2024-8525 has no NVD CVSS score published as of 2026-11-10, so this page gives it no severity rating rather than assuming low or high risk.
Is CVE-2024-8525 being actively exploited?
CVE-2024-8525 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. FIRST's EPSS model puts its probability of exploitation at 1.43%.
What is affected by CVE-2024-8525?
CVE-2024-8525 affects Automated Logic WebCTRL building-management/BMS supervisory server (a Carrier company; the same codebase is also sold as Carrier i-Vu, Automated Logic SiteScan Web, and WebCTRL for OEMs — the central server software that HVAC/BMS integrators use to monitor and control building-automation controllers).
Where does this CVE-2024-8525 information come from?
This advisory is based on NVD, CISA ICS Advisory ICSA-24-326-01, CISA KEV, and FIRST EPSS, cited in full in the Sources section above.
Questions about this page?