Automated Logic WebCTRL / i-Vu server and controllers, BACnet transport trust: This is the vendor formally conceding

Impact

This is the vendor formally conceding the structural problem: WebCTRL inherits BACnet's total absence of network-layer authentication and adds no validation of its own, so an attacker on the BACnet segment can spoof packets to the WebCTRL server or to any Automated Logic controller and have them processed as legitimate. The companion issues are just as bad in practice - service traffic including file contents crosses the wire unencrypted and is trivially readable with Wireshark's BACnet dissector, and under some conditions an attacker can bind the WebCTRL service port and impersonate the server without ever injecting code. Operationally this means write commands to setpoints, fan speeds and schedules can be forged, and the operator has no cryptographic way to tell a real command from a fake one. In a GPU hall the practical consequence is that thermal control is only as trustworthy as the physical and VLAN boundary around the BACnet network, which for most operators is much weaker than they assume.

Who can reach it

Any host that can put packets on the BACnet/IP segment. No credentials exist to steal because none are used. This includes the mechanical contractor's laptop, a compromised BMS workstation, a rogue device in an unlocked mechanical room, and - in a leased colo - anything the landlord has on the shared building network. Also reachable through a BACnet router that bridges IP to MS/TP.

What to do

Partly unpatchable by design. The plaintext and port-binding issues have fixes in current WebCTRL releases and you should take them, but the underlying spoofing exposure is a protocol property: BACnet/IP has no authentication and Automated Logic explicitly says it does not add validation. The only real control is segmentation and physical security of the BACnet segment - dedicated VLAN, no routing to tenant/corporate/internet, port security or 802.1X on the switch ports that carry it, and locked mechanical rooms. Where the vendor supports BACnet Secure Connect (BACnet/SC), moving to it is the actual fix and it is a controller-by-controller project with a contractor, so budget it as a capital line rather than a patch. Leased site: name this in the contract - require BACnet segment isolation with evidence, because you cannot fix someone else's protocol.

References