Automated Logic WebCTRL 7.0 / WebCTRL Premium Server / Carrier i-Vu building automation server: Unauthenticated file

Impact

Unauthenticated file upload leading to remote command execution on the BAS server itself - the machine that holds the graphics, the schedules, the trends and, crucially, the write authority over every controller in the building. A 10.0 here means an attacker who reaches the web port gets to be the building operator. They can command CRAH fans to zero, raise chilled-water setpoints, disable economizers, force valves shut, and edit the schedules so the change survives a reboot and looks intentional. Against a hall of 40-140 kW GPU racks that is minutes to thermal shutdown and a hardware-damage risk, and because the same server owns the trend and alarm database, the attacker can also rewrite what the operator sees while it happens. Owning WebCTRL is strictly better than owning any single controller, and it does not require a single credential from the compute network.

Who can reach it

Unauthenticated HTTP POST to the WebCTRL server. WebCTRL is a Windows/Tomcat application, and it is very commonly published beyond the facility VLAN because facilities staff and the controls contractor want browser access - that is the exposure that turns this from 'facility network' to 'internet-exposed via a badly-placed remote-access box or a public DNS entry'. If your site has a WebCTRL login page reachable from anything other than a jump host, treat that as already compromised until proven otherwise.

What to do

Software upgrade on the BAS server - no controller firmware, no cooling downtime, so this one is genuinely fixable in a normal change window and there is no excuse to defer it. Move to a fixed WebCTRL/i-Vu release per Carrier's advisory. Then do the thing that should have been done first: take the WebCTRL server off any interface reachable from the internet or the corporate LAN, require VPN plus MFA to a jump host, and confirm the Tomcat service account is not a domain administrator. In a leased colo the WebCTRL server is the landlord's and often shared across the whole building - ask for its version and its network position, and treat 'it is behind our VPN' as an unverified claim until you see the rule.

References