External risk intelligence

ALC WebCTRL and Carrier i-Vu Access Control Bypass Leads to Sensitive Information Exposure.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2024-5539

The vulnerability affects web-based building automation servers (ALC WebCTRL and Carrier i-Vu). These systems are frequently deployed as web interfaces to manage facility infrastructure, often requiring remote or external access for facility operators, making them commonly reachable via network interfaces and frequently internet-exposed in typical deployment scenarios.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details an Access Control Bypass vulnerability in certain building automation systems, allowing unauthorized access to sensitive information through their web interfaces.

Bypass access controls, exposing building system data.
Confirm relevance; these systems manage critical infrastructure.
Assess exposure and potential for unauthorized system control.

Attack Path

How an attacker could exploit the issue

An attacker could target the web-based building automation server, which is exposed externally. They would need network access to reach the server and bypass access controls to expose sensitive information.

Entry requires network access.
Trigger involves bypassing access controls.
Risk is sensitive information exposure.

Live Threat

Current exploitation, exposure, and threat context

This Access Control Bypass vulnerability could allow an unauthenticated attacker to bypass intended access restrictions on web-based building automation servers. When successfully exploited, this could expose sensitive information related to building automation systems.

Building automation system data at risk.
Bypass access restrictions to expose information.
Unauthorized access to sensitive system data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Operational ownership for this vulnerability likely falls across infrastructure, platform, and security teams, with ultimate responsibility resting with the application owners of the building automation systems. The first practical step is to identify all instances of ALC WebCTRL and Carrier i-Vu, determine their network exposure and business criticality, and then engage the accountable system owners to plan a risk-based remediation strategy.

Building automation system owners should address.
Verify system reachability and business criticality first.
Coordinate vendor engagement for mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What are ALC WebCTRL and Carrier i-Vu?

These are web-based building automation platforms. They function as centralized servers that facility managers use to control and monitor mechanical infrastructure, such as HVAC, lighting, and security systems in large commercial or industrial buildings. Because they provide a graphical interface for these physical systems, they are often connected to a network to allow authorized personnel to manage building operations remotely.

What does an Access Control Bypass mean for CVE-2024-5539?

This vulnerability is classified as CWE-863, which refers to incorrect authorization. In this context, it means the software fails to properly verify if a user has permission to view specific data. Consequently, a person can circumvent the login or permission checks meant to protect the system and gain unauthorized access to sensitive building automation information that should remain restricted.

How does an attacker trigger this vulnerability?

An attacker needs network access to the web-based building automation server to trigger this flaw. They do not need to provide valid credentials, as the weakness allows them to bypass the system's access controls directly. Simply having network connectivity to the affected server's interface is sufficient to attempt the bypass; actions that do not involve interacting with these specific web-based controls will not trigger the bug.

Why is this CVE considered relevant to my network?

According to Halo Surface Signal, these systems are commonly deployed with internet-facing web interfaces to facilitate remote management by facility operators. Because they are often accessible over a network, servers that are not restricted to internal-only access are significantly more reachable. If your instance is exposed to the internet, it is at higher risk of being reached by unauthorized parties.

What should I do if I use these systems?

Your first step is to inventory your environment to locate all instances of ALC WebCTRL and Carrier i-Vu. Once identified, evaluate whether these servers are accessible from the internet or limited to your internal network, and determine the criticality of the data they manage. Share this information with the specific teams responsible for your building infrastructure so they can coordinate a plan to mitigate the risks.

References

www.corporate.carrier.com/product-security/advisories-resources/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.